Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2024-58366 — rquickjs

🟠 CVSS 8.5 — High ✅ No Known Exploit CWE-134 NVD
8.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Externally Controlled Format String in Scripting Functions

The rquickjs crate used by SurrealDB implements Rust bindings to the QuickJS C library and is used to execute SurrealDB scripting functions. The rquickjs function Exception::throw_type takes a string and returns an error object. Prior to version 0.4.2 of the crate, this string would be fed directly into printf, which will receive the error string as a format string with no additional arguments, leading to undefined behavior. This issue triggers when a SurrealDB scripting function returns an error and its input contains a format string such as %s or %d.

This vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with --allow-scripting or --allow-all and equivalent environment variables SURREAL_CAPS_ALLOW_SCRIPT=true and SURREAL_CAPS_ALLOW_ALL=true.

Impact

An attacker with privileges to execute scripting functions with arbitrary inputs may be able to exploit this format string vulnerability in order read arbitrary memory from the remote SurrealDB process. A format string vulnerability may also be further exploited to execute arbitrary code with the privileges of the SurrealDB process.

The fact that error messages are limited to 256 bytes coupled with [exploit mitigation features supported in Rust executables](https://doc.rust-lang.org/rustc/exploit-mitigations.html#exploit-mitigations-1) may somewhat increase the complexity of exploiting this vulnerability to reliably achieve remote code execution in practice.

Patches

  • Version 1.1.1 and later are not affected by this issue.

Workarounds

Users unable to update should restrict access from untrusted users to define and execute scripting functions. This can be achieved by removing the scripting capability by default or with --deny-scripting and equivalent environment variable SURREAL_CAPS_DENY_SCRIPT=true. If not possible, network access should be limited to trusted users.

References

  • https://github.com/surrealdb/surrealdb/issues/3327
  • https://github.com/surrealdb/surrealdb/pull/3332
  • https://github.com/DelSkayn/rquickjs/pull/247

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is high, an attacker needs low-level privileges on the target. No user interaction is required. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality high, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Attack vector: Network — reachable from anywhere that can route to the service.
  • Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
  • Privileges required: Low — an ordinary user account is enough.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Changed — a successful attack reaches components beyond the vulnerable one.
  • Confidentiality impact: High — total loss, or loss the attacker controls.
  • Integrity impact: High — total loss, or loss the attacker controls.
  • Availability impact: High — total loss, or loss the attacker controls.

Weakness class

CVE-2024-58366 is classified as CWE-134: Externally Controlled Format String. User input is used as a format string, letting an attacker read or write memory through format specifiers.

Affected software

CVE-2024-58366 is recorded against 2 packages.

  • rquickjs (fixed in 0.4.2)
  • surrealdb

Timeline and source

Published on 18 July 2026 and last revised on 13 August 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com
www.vulncheck.com

Same weakness in other software

These advisories are the same class of weakness (CWE-134: Externally Controlled Format String) in other software:

Details

Severity HIGH
CVSS Score 8.5
CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE CWE-134
Public Exploit ✅ No
Source NVD
Published 2026-07-18
Updated 2026-08-20
Modified 2026-08-13
Fix URL N/A

Affected Packages

Software From version Fixed in
rquickjs — 0.4.2
surrealdb — —

Site Security Check

Is rquickjs part of your stack?

CVE-2024-58366 is rated CVSS 8.5 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2024
✓