GHSA-2JX3-FF3V-J7JJ yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB

!NOTE This finding was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review and verification. The Issue The crate exports a public safe API Rules::deserialize accepting any generic byte sequence B: AsRef. It restores compiled rule structures direct...

Duplicate Advisory: Untrusted Query Object Evaluation in RPC API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-64f8-pjgr-9wmr. This link is maintained to preserve external references. Original Description SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup...

GHSA-XW2C-HRR9-4XWR Duplicate Advisory: Untrusted Query Object Evaluation in RPC API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-64f8-pjgr-9wmr. This link is maintained to preserve external references. Original Description SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup...

CVE-2024-58362

SurrealDB vulnerability CVE-2024-58362 affects prior releases (before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3) where an arbitrary object can be accepted in signin/signup via the RPC API without recursive validation for non-computed values. An unauthenticated attacker could encode a binary object...

CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

EUVD-2024-55678

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

RUSTSEC-2025-0141 Bincode is unmaintained

Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently. The team considers version 1.3.3 a complete version of bincode that is not in need of any updates. Alternatives to consider wincode postcard bitcode rkyv...

a-gpt (>=0.1.0, <=0.4.0), a2f (>=0.1.0, <=0.4.0) +6572 more potentially affected by unknown CVE via bincode (>=0.0.1, <=3.0.0)

bincode CARGO version =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.10.0-dev0, =0.3.0, =0.1.0, =0.1.13, =0.1.0, =0.1.0, =0.1.0, =0.1.1 - accountnovafi5 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0141...

PT-2025-54578

Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently. The team considers version 1.3.3 a complete version of bincode that is not in need of any updates. Alternatives to consider wincode postcard bitcode rkyv...

Untrusted Query Object Evaluation in RPC API

During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...

GHSA-64F8-PJGR-9WMR Untrusted Query Object Evaluation in RPC API

During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...

PT-2024-40112

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 1.5.5 SurrealDB versions prior to 2.0.0-beta.3 Description: The issue arises during sign in and sign up operations through the SurrealDB RPC API, where an arbitrary object is accepted to support various types and...

PT-2026-60942

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.5.5 SurrealDB versions 2.0.0-beta through 2.0.0-beta.2 Description The RPC API accepts arbitrary objects in the signin and signup operations without recursively validating them for non-computed values. When a reco...