SurrealDB Injection Flaw Risks Control

A severe security vulnerability has been identified within the SurrealDB ecosystem, centered on how the platform handles table and field naming conventions. This flaw, tracked as CVE-2025-71392, centers on the command-line export utility and its failure to properly escape specific identifiers.

The Mechanics of Injection

The core issue originates in the database's export functionality. When an authenticated System User assigned the OWNER or EDITOR role creates tables or fields that incorporate malicious SurrealQL strings, the system does not adequately neutralize the input. This vulnerability affects multiple versions of the database software.

• SurrealDB versions before 2.0.5
• SurrealDB versions 2.1.x before 2.1.5
• SurrealDB versions 2.2.x before 2.2.2

Risks of Second-Order Execution

The danger is not limited to the immediate environment where the malicious name is created. The vulnerability facilitates a universal second-order SurrealQL injection. This occurs when a user with higher privileges triggers an import process using an exported backup generated from the compromised instance. Once that process begins, the injected code executes, which can lead to privilege escalation and full root-level takeover of the affected database instance.

Furthermore, the advisory notes that applications permitting end-users to define their own custom tables or fields remain exposed to this attack vector, even in scenarios where standard query parameters are subjected to sanitization processes.

Implications for Database Security

The discovery of this flaw suggests that administrative workflows surrounding database backups require a high level of scrutiny, particularly when those backups originate from systems where users possess the permissions to alter schema definitions. Given that the injection can be triggered by a higher-privileged user importing existing data, the integrity of the export file becomes a critical point of failure in the security lifecycle. Organizations utilizing these specific versions of SurrealDB may need to review their administrative user roles and the potential for malicious inputs in automated or manual data handling tasks to mitigate the risk of unauthorized system control.