CVE-2024-58366 is a format string vulnerability affecting SurrealDB prior to version 1.1.1. The flaw exists in the rquickjs Exception::throw_type function used when scripting is enabled. Attackers who have scripting privileges can exploit this vulnerability by supplying crafted format string sequences in error inputs, which may allow them to read arbitrary memory or execute code with the same privileges as the SurrealDB process. This vulnerability is categorized under CWE-134 (Use of Externally-Controlled Format String). No known exploits in the wild have been reported, and no official patch or remediation details are provided in the source data.

Successful exploitation can lead to arbitrary memory disclosure or remote code execution with the privileges of the SurrealDB process. This can compromise the confidentiality and integrity of the system running SurrealDB. The vulnerability requires that the attacker already has scripting privileges, which limits the attack surface to users with some level of access to the scripting environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is provided in the available data, users should monitor SurrealDB vendor communications for updates. Until a fix is available, restricting scripting privileges to trusted users and disabling scripting if not required can reduce the risk of exploitation.