EUVD-2025-210487
GHSA-6g9r-xqrf-34xh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default scripting configuration is a meaningful prerequisite mapped to AC:H; PR:L for required authentication; availability impact is partial only with no C or I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.
AnalysisAI
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by submitting long-running or infinite JavaScript functions that consume server CPU and thread resources without bound. Affected deployments must have explicitly enabled the scripting capability - it is off by default - making this a narrow but real risk in multi-tenant or shared SurrealDB environments where not all authenticated users are fully trusted. No public exploit identified at time of analysis; discovered during a professional code audit and penetration test conducted by cure53, rated Low severity by both cure53 and the vendor.
Technical ContextAI
SurrealDB (cpe:2.3:a:surrealdb:surrealdb) is a Rust-based multi-model database that supports embedded JavaScript scripting functions via SurrealQL for advanced query logic. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): while JS function execution was bounded for memory and stack size, no wall-clock execution-time limit was enforced. A submitted JavaScript function could therefore run indefinitely, tying up server workers. The fix, implemented in PR #5597, introduces a default execution-time timeout for scripting functions, configurable via the SURREAL_SCRIPTING_MAX_TIME_LIMIT environment variable. The scripting subsystem is activated by the --allow-scripting or --allow-all flags, or equivalently by the SURREAL_CAPS_ALLOW_SCRIPT=true or SURREAL_CAPS_ALLOW_ALL=true environment variables.
RemediationAI
Upgrade to SurrealDB 2.0.5, 2.1.5, or 2.2.2, which implement a default execution-time limit for JavaScript scripting functions. The fix (PR #5597: https://github.com/surrealdb/surrealdb/pull/5597) also exposes the SURREAL_SCRIPTING_MAX_TIME_LIMIT environment variable for operators who need to tune the timeout. For deployments that cannot immediately upgrade, disable scripting by starting SurrealDB with the --deny-scripting flag or by setting SURREAL_CAPS_DENY_SCRIPT=true; this workaround fully eliminates the attack surface but disables all embedded JavaScript function execution, which will break any SurrealQL queries that rely on scripting. The vendor advisory is at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7 and SurrealDB capability documentation is at https://surrealdb.com/docs/surrealdb/security/capabilities.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today