Dashboard / CVE-2025-71393

CVE-2025-71393

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 62/100
Published: 2026-07-18 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: Present
VC: None
VI: None
VA: High

Description

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

Weakness Classification (1)

Affected Software (7)

VendorProductVersion
surrealdb surrealdb 2.2.0 < 2.2.2
surrealdb surrealdb 2.1.0 < 2.1.5
surrealdb surrealdb 0 < 2.0.5
surrealdb surrealdb < 2.0.5
surrealdb surrealdb 2.2.0 < 2.2.2
surrealdb surrealdb 2.1.0 < 2.1.5
surrealdb surrealdb 0 < 2.0.5

References & Advisories (2)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.46%
Raw Score 0.004610
Percentile 39.9%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links