{"id":"CVE-2024-58366","aliases":["GHSA-q3gg-m8hr-h4x4"],"url":"https://o3.security/vulnerability/CVE-2024-58366","summary":"SurrealDB before 1.1.1 Format String via Scripting Functions","details":"The `rquickjs` crate used by SurrealDB implements Rust bindings to the QuickJS C library and is used to execute SurrealDB scripting functions. The `rquickjs` function `Exception::throw_type` takes a string and returns an error object. Prior to version `0.4.2` of the crate, this string would be fed directly into `printf`, which will receive the error string as a format string with no additional arguments, leading to undefined behavior. This issue triggers when a SurrealDB scripting function returns an error and its input contains a format string such as `%s` or `%d`. \n\nThis vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with `--allow-scripting` or `--allow-all` and equivalent environment variables `SURREAL_CAPS_ALLOW_SCRIPT=true` and `SURREAL_CAPS_ALLOW_ALL=true`.\n\n### Impact\n\nAn attacker with privileges to execute scripting functions with arbitrary inputs may be able to exploit this format string vulnerability in order read arbitrary memory from the remote SurrealDB process. A format string vulnerability may also be further exploited to execute arbitrary code with the privileges of the SurrealDB process.\n\nThe fact that error messages are limited to 256 bytes coupled with [exploit mitigation features supported in Rust executables](https://doc.rust-lang.org/rustc/exploit-mitigations.html#exploit-mitigations-1) may somewhat increase the complexity of exploiting this vulnerability to reliably achieve remote code execution in practice.\n\n### Patches\n\n- Version 1.1.1 and later are not affected by this issue.\n\n### Workarounds\n\nUsers unable to update should restrict access from untrusted users to define and execute scripting functions. This can be achieved by removing the scripting capability by default or with `--deny-scripting` and equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. If not possible, network access should be limited to trusted users.\n\n### References\n\n- https://github.com/surrealdb/surrealdb/issues/3327\n- https://github.com/surrealdb/surrealdb/pull/3332\n- https://github.com/DelSkayn/rquickjs/pull/247","published":"2026-07-18T13:10:06.939Z","modified":"2026-10-31T02:30:53.781235469Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"surrealdb","fixedVersion":"1.1.1"}],"fix":{"url":"https://github.com/surrealdb/surrealdb/pull/3332","label":"surrealdb/surrealdb#3332"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58366.json"},{"type":"ADVISORY","url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58366"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions"},{"type":"WEB","url":"https://github.com/surrealdb/surrealdb/issues/3327"},{"type":"WEB","url":"https://github.com/surrealdb/surrealdb/pull/3332"},{"type":"PACKAGE","url":"https://github.com/surrealdb/surrealdb"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-31T02:30:53.781235469Z"}}