Threats affecting pkg:cargo/surrealdb-core

Surrealdb-core versions prior to 4.0.0 contain a concurrency vulnerability due to unsound implementations of Send and Sync traits in the reblessive crate. This flaw allows data races and double free conditions when futures are duplicated and polled concurrently across threads, potentially leading to memory corruption and high-impact consequences. The issue was fixed in version 4.0.0 by removing the unsound dependency and changing the parser implementation.

SurrealDB versions prior to 3.2.0 contain a vulnerability where a PERMISSIONS clause that includes data-modifying statements can bypass table write permissions. This allows users with permission to perform an operation guarded by such a clause to write to tables they normally cannot modify. The issue is limited to permission clauses that contain write operations; read-only permission clauses are unaffected. The vulnerability does not allow privilege escalation beyond the caller's namespace or database, nor does it allow reading hidden data. Versions 3.2.0 and later have patched this issue by enforcing that permission clauses must be read-only and blocking writes during permission evaluation.