3 results · Clear filters · Feed
-
High 7.8
Data race and double free via unsound `Send`/`Sync` in `reblessive`
`dbs::Executor` drives every SurrealQL statement through `reblessive::tree::TreeStack`. In `reblessive 0.4.3` the runtime types unconditionally assert `Send`/`Sync` (`unsafe impl Send/Sync for Stack`, `TreeStack` and `Runner`), while the public entry points a…
-
High 7.1
SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions
SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operati…
-
High 8.8
SurrealDB before 1.5.5 Query Injection via RPC API
SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query …