SurrealDB CVE-2026-63762

Two non-default capabilities must be simultaneously active: (1) --allow-scripting (or its absence of a --deny-scripting flag), which enables the embedded QuickJS-NG JavaScript runtime - this capability is disabled by default and must be explicitly configured; and (2) at minimum one user class with query execution rights, which in practice means either an authenticated user (record, system, or guest user type) or unauthenticated guest access via --allow-guests. Without --allow-scripting, no attack surface exists regardless of any other configuration. Without any query-executing principal, the payload cannot be delivered. When both scripting and guest access are enabled, exploitation requires only network connectivity to the SurrealDB query endpoint with no authentication. Limiting factors: the non-default scripting flag is the primary gate; deployments using only the default configuration are fully unexposed; the attack cannot cross a scope boundary, execute code, or access data - impact is strictly process termination requiring manual restart.

The CVSS 4.0 score of 6.0 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H) reflects the core tension in this vulnerability: network-reachable with low complexity, but gated behind a non-default capability (AT:P). The attack requirement AT:P is the decisive signal - without --allow-scripting explicitly enabled, no exploitation path exists regardless of user privileges or network position. PR:L indicates that at minimum an authenticated user with query execution rights is needed; however, if --allow-guests is also enabled, that constraint dissolves to unauthenticated access, increasing real-world risk substantially for such deployments. Impact is strictly availability (VA:H), with vendor confirmation that confidentiality and integrity cannot be compromised. No EPSS data was provided, and the vulnerability has no CISA KEV listing and no known public proof-of-concept code, suggesting exploitation has not been observed in the wild. Real-world priority should be calibrated accordingly: for deployments with scripting disabled (the default), risk is zero; for deployments with scripting and guest access both enabled, the risk profile is closer to a critical availability issue affecting unauthenticated endpoints.

An attacker with query execution access to a SurrealDB instance that has --allow-scripting enabled submits a crafted SurrealQL query that invokes built-in string functions to construct an abnormally large string, then passes it to the embedded JavaScript runtime for compilation. The exact string size required to trigger the crash varies across SurrealDB versions, but no special tooling is needed - the attack is deliverable via any standard SurrealDB query interface. The QuickJS-NG engine dereferences a null pointer during compilation, the server process terminates instantly, and the database remains unavailable until an operator manually restarts it; if --allow-guests is also enabled, this attack is executable without any credentials.