Format String Vulnerability in SurrealDB Scripting Engine

SurrealDB versions before 1.1.1 contain a format string vulnerability in the rquickjs Exception::throw_type function that can be exploited when scripting is enabled. An attacker with scripting privileges can inject format string sequences into error inputs, allowing them to read arbitrary memory locations or execute arbitrary code with the privileges of the SurrealDB process. This vulnerability is particularly concerning for organizations using SurrealDB as a backend database with scripting features enabled, as it provides a direct path to code execution for authenticated users or attackers who have gained scripting access through other means. The CVSS score of 8.5 reflects the high severity—combining network accessibility potential with significant impact on confidentiality and integrity.

Detecting exploitation of this vulnerability requires understanding the attack flow: an attacker must craft malicious error messages containing format string payloads (like %x, %s, or %n sequences) to trigger the vulnerable function. While this CVE maps to CWE-134 (Use of Externally-Controlled Format String), Casky's security skills—powered by Claude's extended reasoning capabilities—would identify the behavioral patterns associated with format string attacks by analyzing process memory access anomalies, unexpected code execution following error handling routines, and suspicious input patterns in scripting contexts. Practitioners using Casky would observe findings related to unusual format string patterns in application logs, unexpected memory reads or writes initiated from the database layer, and privilege escalation attempts following scripting operations. Organizations should immediately upgrade to SurrealDB 1.1.1 or later and restrict scripting privileges to trusted users only.