CVE-2024-58366Disclosure(delskayn / rquickjs)

LOWCVSS 8.8 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

Patch delskayn rquickjs systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

delskayn CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-134

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

rquickjs
surrealdb

Threat summary

Patch or workaround signal is available
4 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
4 total mentions across 1 day

Affected systems

Vendors

delskayn surrealdb

Products

rquickjssurrealdb

Deep dive

Activity timeline4 mentions / 1d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Full discourse4 posts

Vulmon Vulnerability Feed@VulmonFeeds92d
General
CVE-2024-58366 Format String Vulnerability in SurrealDB Before 1.1.1 Scripting E... https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-58366 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces a format string vulnerability (CVE-2024-58366) in SurrealDB before version 1.1.1 and provides a link for additional details, but offers no evidence of exploitation, PoC, or mitigation.
00000102
4.1K followersView on X
Upwind Security MDR@UpwindMDR93d
Patch
🚨Critical - SurrealDB Format String RCE via Scripting (CVE-2024-58366) SurrealDB before 1.1.1 passes attacker-influenced error input as a format string in the rquickjs Exception::throw_type function when scripting is enabled. An attacker with scripting privileges can supply format-string sequences to read arbitrary process memory or execute code with SurrealDB's privileges. The root cause is in rquickjs, the Rust binding to the QuickJS engine, fixed upstream in 0.4.2. Attack complexity is high and scripting must be enabled, but the impact is memory disclosure to full code execution. CVSS 9.0. 👉Upgrade SurrealDB to 1.1.1 or later; other Rust projects should update rquickjs to 0.4.2 or later.
Post summary
CVE-2024-58366 is a critical format‑string RCE in SurrealDB that allows memory disclosure and full code execution when scripting is enabled; upgrading to SurrealDB 1.1.1 or later (or updating rquickjs to 0.4.2) resolves the issue.
00000100
254 followersView on X
Infoflowcloud@infoflowcloud93d
Disclosure
🚨*CVE* CVE-2024-58366 SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privi… https://www.cve.org/CVERecord?id=CVE-2024-58366 ----- Traducción: CVE-2024-58366 Sur… http://infoflow.cloud`
Post summary
SurrealDB versions before 1.1.1 are disclosed to have a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled, but no PoC or active exploitation details are present.
0000033
92 followersView on X
CVE@CVEnew93d
Disclosure
CVE-2024-58366 SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privi… https://www.cve.org/CVERecord?id=CVE-2024-58366
Post summary
The statement reports that SurrealDB versions before 1.1.1 contain a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled; no PoC, exploit, or patch information is provided.
00000617
57.8K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	delskayn	rquickjs	-	rust	-
App	surrealdb	surrealdb	-	-	-

Explore more

Back to dashboard delskayn CVEs surrealdb CVEs rquickjs vulnerabilities

What researchers are saying

CVE-2024-58366

Upwind Security MDR[verified]@UpwindMDRPatch

CVE-2024-58366 is a critical format‑string RCE in SurrealDB that allows memory disclosure and full code execution when scripting is enabled; upgrading to SurrealDB 1.1.1 or later (or updating rquickjs to 0.4.2) resolves the issue.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post announces a format string vulnerability (CVE-2024-58366) in SurrealDB before version 1.1.1 and provides a link for additional details, but offers no evidence of exploitation, PoC, or mitigation.

Infoflowcloud@infoflowcloudDisclosure

SurrealDB versions before 1.1.1 are disclosed to have a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled, but no PoC or active exploitation details are present.

CVE@CVEnewDisclosure

The statement reports that SurrealDB versions before 1.1.1 contain a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled; no PoC, exploit, or patch information is provided.