-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from incorrect ordering of transaction commits and field updates in table definition operations. Both files show the pattern: 1) In define/table.rs, the vulnerable version called txn.set() before adding relational fields via add_in_out_fields. 2) In alter/table.rs, the same pattern existed with early txn.set(). This meant permission changes in OVERWRITE operations weren't persisted when tables had relations, as the final state with updated permissions wasn't written to storage. The patch fixes this by making add_in_out_fields modify the table definition before committing to storage.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| surrealdb | rust | >= 2.0.0, < 2.1.4 | 2.1.4 |
| surrealdb-core | rust | >= 2.0.0, < 2.1.4 | 2.1.4 |
Ongoing coverage of React2Shell