SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. (CVE-2025-71392)
SurrealDB versions before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 contain a vulnerability in the command-line export command where table and field names are not properly escaped. This allows an authenticated System User with OWNER or EDITOR roles to inject malicious SurrealQL code via crafted table or field names. When a higher-privileged user imports the exported backup, the injected code executes, enabling privilege escalation and potential root-level takeover of the SurrealDB instance. Applications permitting user-defined tables or fields are also vulnerable to a universal second-order SurrealQL injection, even if query parameters are sanitized.
AI Analysis
Technical Summary
The vulnerability (CVE-2025-71392) affects SurrealDB versions prior to 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2. It arises from improper escaping of table and field names in the command-line export command. An authenticated user with OWNER or EDITOR roles can create maliciously named tables or fields containing SurrealQL injection payloads. When a higher-privileged user imports the backup, the injected SurrealQL executes, leading to privilege escalation and root-level control of the SurrealDB instance. This also exposes applications that allow user-defined tables or fields to a second-order SurrealQL injection, bypassing query parameter sanitization.
Potential Impact
Successful exploitation allows an authenticated user with OWNER or EDITOR roles to escalate privileges to root-level on the SurrealDB instance. This can result in full compromise of the database, including unauthorized data access, modification, and control over the database environment. The vulnerability affects the integrity, confidentiality, and availability of the SurrealDB system.
Mitigation Recommendations
A fix is available in SurrealDB versions 2.0.5, 2.1.5, and 2.2.2 and later. Users should upgrade to these versions or later to remediate the vulnerability. There is no indication that the vendor has stated 'no action required' or that the issue is already mitigated without patching. Therefore, upgrading to the fixed versions is the recommended mitigation.
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. (CVE-2025-71392)
Description
SurrealDB versions before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 contain a vulnerability in the command-line export command where table and field names are not properly escaped. This allows an authenticated System User with OWNER or EDITOR roles to inject malicious SurrealQL code via crafted table or field names. When a higher-privileged user imports the exported backup, the injected code executes, enabling privilege escalation and potential root-level takeover of the SurrealDB instance. Applications permitting user-defined tables or fields are also vulnerable to a universal second-order SurrealQL injection, even if query parameters are sanitized.
CVSS v3.1
Score 8.0high
Affected software
pkg:github/surrealdb/surrealdbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2025-71392) affects SurrealDB versions prior to 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2. It arises from improper escaping of table and field names in the command-line export command. An authenticated user with OWNER or EDITOR roles can create maliciously named tables or fields containing SurrealQL injection payloads. When a higher-privileged user imports the backup, the injected SurrealQL executes, leading to privilege escalation and root-level control of the SurrealDB instance. This also exposes applications that allow user-defined tables or fields to a second-order SurrealQL injection, bypassing query parameter sanitization.
Potential Impact
Successful exploitation allows an authenticated user with OWNER or EDITOR roles to escalate privileges to root-level on the SurrealDB instance. This can result in full compromise of the database, including unauthorized data access, modification, and control over the database environment. The vulnerability affects the integrity, confidentiality, and availability of the SurrealDB system.
Mitigation Recommendations
A fix is available in SurrealDB versions 2.0.5, 2.1.5, and 2.2.2 and later. Users should upgrade to these versions or later to remediate the vulnerability. There is no indication that the vendor has stated 'no action required' or that the issue is already mitigated without patching. Therefore, upgrading to the fixed versions is the recommended mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h5q3-3v5q-v5j8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-71392"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
Threat ID: 6a5ba17e44ab8fbf7c789b97
Added to database: 07/18/2026, 15:53:34 UTC
Last enriched: 08/13/2026, 19:15:18 UTC
Last updated: 09/01/2026, 10:52:06 UTC
Views: 104
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.