CVE-2025-71392 surrealdb CVE debrief

Who should care

Defenders responsible for managing SurrealDB instances should assess exposure and prioritize patching to prevent potential privilege escalation attacks. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.

Why it matters

CVE-2025-71392 is a critical vulnerability in SurrealDB that allows privilege escalation and root-level takeover of the SurrealDB instance. Defenders should prioritize patching SurrealDB instances and monitor for suspicious activity.

• Privilege escalation to root-level takeover of the SurrealDB instance
• Potential for universal second-order SurrealQL injection in applications that let users define custom tables or fields
• Need for patching SurrealDB instances to prevent potential attacks
• Importance of monitoring SurrealDB instances for suspicious activity

Technical summary

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance.

Defensive priority

Defenders should prioritize patching SurrealDB instances to prevent potential privilege escalation attacks.

Recommended defensive actions

• Patch SurrealDB instances to version 2.0.5, 2.1.5, or 2.2.2
• Restrict access to SurrealDB instances to only trusted users
• Monitor SurrealDB instances for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by SurrealDB's failure to properly escape table and field names in the command-line export command. This allows an authenticated System User with OWNER or EDITOR roles to create tables or fields with malicious names containing SurrealQL.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.