CVE-2024-58366CWE-134

CVE-2024-58366

High · published July 18, 2026

CVSS v3.1
8.5
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.4th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2026-07-18T18:17Z
Affected products (2)
ProductVersionsFixed in
delskayn/rquickjs< 0.4.20.4.2
surrealdb/surrealdb< 1.1.11.1.1
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4 · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 1.1.1 Format String via Scripting Functions
    cvelistv5