Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-18 | 3 | Disclosure1General1Patch1 |
| 2026-07-19 | 1 | Patch1 |
| 2026-09-30 | 1 | Patch1 |
🚨 HIGH: CVE-2025-71392 (CVSS 8.0) - SurrealDB SQL injection flaw allows privilege escalation to root. Affects versions <2.0.5, 2.1.x <2.1.5, 2.2.x <2.2.2. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/fUX8v3fDv1
Post summary
The tweet discloses CVE-2025-71392, a SQL injection flaw in SurrealDB with CVSS 8.0 that enables privilege escalation, and urges immediate patching of affected versions.
CVE-2025-71392 (CVSS 9.4): SurrealDB export command fails to escape table/field names. Update to 2.0.5+, 2.1.5+, or 2.2.2+ if in use. https://nvd.nist.gov/vuln/detail/CVE-2025-71392 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/b2fhHv26dK
Post summary
CVE‑2025‑71392 exposes a high‑severity command‑injection flaw in SurrealDB due to unsanitized table/field names; the vulnerability is patched in newer releases, and no active exploitation is reported.
🚨Critical - SurrealDB Second-Order SurrealQL Injection via Export (CVE-2025-71392) SurrealDB does not properly escape table and field names in its command-line export command. An authenticated user with OWNER or EDITOR roles can create tables or fields whose names embed malicious SurrealQL. When a higher-privileged user later imports that exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the instance. Applications that let users define custom table or field names are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized. CVSS 9.4. 👉Upgrade SurrealDB to 2.0.5, 2.1.5, or 2.2.2 depending on your branch.
Post summary
The advisory discloses a critical second‑order SurrealQL injection flaw in SurrealDB that allows privilege escalation via export/import, provides a CVSS 9.4 rating, and recommends upgrading to specific patched versions.
CVE-2025-71392 SurrealQL Injection in SurrealDB Export Command Enables Privilege Escalation https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71392
Post summary
The tweet simply announces CVE‑2025‑71392 with a brief title and a link, lacking any technical specifics, PoC, patches, or exploitation reports.
CVE-2025-71392 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated… https://www.cve.org/CVERecord?id=CVE-2025-71392
Post summary
A brief disclosure of CVE‑2025‑71392 reveals that SurrealDB versions prior to 2.0.5, 2.1.5, and 2.2.2 do not correctly escape table and field names in the export command, potentially exposing an injection flaw.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | surrealdb | surrealdb | - | - | - |