GHSA-3v2x-9xcv-2v2v
NoneCVSS
—
EPSS
—
Published
Jan 22, 2026
CISA due date
—
The record
SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | surrealdb | 0 | 2.5.0 |
| crates.io | surrealdb | 3.0.0-alpha.1 | 3.0.0-beta.3 |
| cargo | surrealdb | 3.0.0-alpha.1 | 3.0.0-beta.3 |
Related vulnerabilities
- GHSA-xx7m-69ff-9crp SurrealDB vulnerable to Denial of Service through scripting function memory edge case Also affects surrealdb
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-86003 CoreDNS is a DNS server written in Go. CWE-441
- CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87453 Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-441
- CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441