SurrealQL injection in SurrealDB export command (CVE-2025-71392)

SurrealDB's command-line export command fails to properly escape table and field names, enabling SurrealQL injection in exported backup files. An authenticated System User with OWNER or EDITOR roles can craft malicious table or field names; when a higher-privileged user imports the resulting backup, the injected SurrealQL executes, allowing privilege escalation and full root-level takeover of the SurrealDB instance. Applications permitting user-defined tables or fields are additionally exposed to universal second-order SurrealQL injection even when query parameters are sanitized. Affected versions: - < 2.0.5 - < 2.1.5 - < 2.2.2 We recommend updating to: 2.0.5, 2.1.5, 2.2.2. CVSS 9.4 · our assessment: act_now Vendor advisory: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42 Details: https://vuln.today/cve/CVE-2025-71392