SurrealDB versions prior to 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 do not properly escape table and field names in the command‑line export command. An authenticated System User with OWNER or EDITOR privileges can create maliciously named tables or fields that contain SurrealQL statements. When a higher‑privileged user subsequently imports the exported backup, the injected SurrealQL code executes, allowing the attacker to elevate privileges and take full control of the SurrealDB instance. Applications that permit user defined tables or fields are likewise exposed to a universal second‑order SurrealQL injection, even if individual query parameters are sanitized. This vulnerability is classified as CWE‑77.

The affected vendor is SurrealDB, product SurrealDB. The vulnerability applies to all releases before version 2.0.5, any 2.1.x series prior to 2.1.5, and the 2.2.x series before 2.2.2. Any deployment using these versions without the necessary patch is susceptible.

The severity is reflected in a CVSS score of 9.4 and an EPSS score of less than 1%, indicating a high impact but low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with OWNER or EDITOR privileges to create malicious names and a separate privileged user to import the compromised export. The attack path is therefore limited to environments where such role separation exists or where applications allow arbitrary table or field creation.