SurrealDB before versions 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL injection payloads. When a higher-privileged user imports the exported backup, the injected SurrealQL executes, resulting in privilege escalation and root-level takeover of the SurrealDB instance. This vulnerability also allows universal second-order SurrealQL injection in applications that permit user-defined tables or fields, even if query parameters are sanitized. The vulnerability is tracked as CVE-2025-71392 and classified under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Successful exploitation allows an authenticated user with OWNER or EDITOR roles to escalate privileges to root-level access on the SurrealDB instance by injecting malicious SurrealQL commands through table or field names. This can lead to complete compromise of the database and potentially the underlying system. The vulnerability also affects applications that allow user-defined tables or fields, exposing them to second-order injection attacks despite query parameter sanitization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict OWNER and EDITOR role assignments to trusted users only and avoid importing backups from untrusted sources. Monitor vendor communications for patches addressing this issue.