Security readout for executives and security teams
Plain-English summary
A lower-privileged authenticated SurrealDB user can hide database commands inside table or field names. Those commands execute when a more privileged user imports an affected export, potentially giving the attacker root-level control. Applications allowing users to define custom schema elements may also be exposed even when normal query parameters are sanitized.
Executive priority
Prioritize emergency remediation where custom schema creation, delegated database roles, or privileged backup imports exist. The potential outcome is complete database takeover. Other affected instances still require prompt upgrading because trusted accounts or compromised applications could satisfy the prerequisite conditions.
Technical view
The export command does not correctly escape table and field identifiers, creating a second-order SurrealQL injection. An OWNER or EDITOR System User can create a malicious identifier that becomes executable SurrealQL in an exported backup. Importing that backup under higher privileges can compromise confidentiality, integrity, availability, and the wider SurrealDB instance.
Likely exposure
Exposure requires an affected SurrealDB version and an authenticated user or application workflow able to define tables or fields. Risk becomes acute where exports are later imported by higher-privileged operators. Affected releases are before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not identified as being in CISA KEV. Exploitation requires low privileges plus a subsequent privileged import, but complexity is low once those conditions exist. Custom-schema applications broaden exposure through second-order injection.
Researcher notes
This is CWE-77 caused by unsafe identifier escaping in export generation, not ordinary parameter injection. Validation should focus on generated export structure and privilege boundaries without executing malicious content. The public evidence supports root-level takeover after privileged import, but does not demonstrate exploitation in the wild.
Mitigation direction
- Upgrade to 2.0.5, 2.1.5, 2.2.2, or a later supported release for the deployed branch.
- Restrict OWNER and EDITOR roles to trusted identities until upgrades are complete.
- Prevent untrusted users and applications from defining table or field names.
- Treat exports from affected instances as untrusted; follow vendor guidance before privileged import.
- Review vendor guidance for any additional branch-specific remediation or backup-handling requirements.
Validation and detection
- Inventory SurrealDB versions and classify each instance against the affected branch ranges.
- Identify applications that allow users to create custom tables or fields.
- Review OWNER and EDITOR assignments for unnecessary or externally reachable accounts.
- Determine whether exports from affected instances were imported using more privileged credentials.
- Confirm upgraded instances no longer use affected versions before resuming privileged imports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-71392 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-ccj3-5p93-8p42)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SurrealDB before 2.2.2 SurrealQL Injection via exportCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.