Threats tagged 'ghsa-347j-rmf7-f74x'

SurrealDB versions from 2.0.0 up to but not including 3.3.1 have a vulnerability where the --deny-funcs restrictions are not enforced on method-style function calls in the streaming engine. This allows authenticated users who can submit queries to bypass function denial policies and execute restricted functions such as file bucket read/write operations via method syntax.