High severity8.5NVD Advisory· Published Jul 18, 2026· Updated Aug 13, 2026

CVE-2024-58366

Description

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Delskayn/Rquickjs
cpe:2.3:a:delskayn:rquickjs:*:*:*:*:*:rust:*:*
Range: <0.4.2
Surrealdb/Surrealdb2 versions
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*range: <1.1.1
- (no CPE)range: <1.1.1

Patches

Vulnerability mechanics

References

github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4nvdVendor Advisory
www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functionsnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.552
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000