EUVD-2025-210487
GHSA-6g9r-xqrf-34xh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default scripting configuration is a meaningful prerequisite mapped to AC:H; PR:L for required authentication; availability impact is partial only with no C or I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.
AnalysisAI
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by submitting long-running or infinite JavaScript functions that consume server CPU and thread resources without bound. Affected deployments must have explicitly enabled the scripting capability - it is off by default - making this a narrow but real risk in multi-tenant or shared SurrealDB environments where not all authenticated users are fully trusted. No public exploit identified at time of analysis; discovered during a professional code audit and penetration test conducted by cure53, rated Low severity by both cure53 and the vendor.
Technical ContextAI
SurrealDB (cpe:2.3:a:surrealdb:surrealdb) is a Rust-based multi-model database that supports embedded JavaScript scripting functions via SurrealQL for advanced query logic. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): while JS function execution was bounded for memory and stack size, no wall-clock execution-time limit was enforced. A submitted JavaScript function could therefore run indefinitely, tying up server workers. The fix, implemented in PR #5597, introduces a default execution-time timeout for scripting functions, configurable via the SURREAL_SCRIPTING_MAX_TIME_LIMIT environment variable. The scripting subsystem is activated by the --allow-scripting or --allow-all flags, or equivalently by the SURREAL_CAPS_ALLOW_SCRIPT=true or SURREAL_CAPS_ALLOW_ALL=true environment variables.
RemediationAI
Upgrade to SurrealDB 2.0.5, 2.1.5, or 2.2.2, which implement a default execution-time limit for JavaScript scripting functions. The fix (PR #5597: https://github.com/surrealdb/surrealdb/pull/5597) also exposes the SURREAL_SCRIPTING_MAX_TIME_LIMIT environment variable for operators who need to tune the timeout. For deployments that cannot immediately upgrade, disable scripting by starting SurrealDB with the --deny-scripting flag or by setting SURREAL_CAPS_DENY_SCRIPT=true; this workaround fully eliminates the attack surface but disables all embedded JavaScript function execution, which will break any SurrealQL queries that rely on scripting. The vendor advisory is at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7 and SurrealDB capability documentation is at https://surrealdb.com/docs/surrealdb/security/capabilities.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth l
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumven
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach inte
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record user
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today