CVE-2025-71396

creationtimestamp| type| source ---|---|--- 2026-07-18 15:57:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwmyb5u6r2a...

CVE-2025-71396

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled via --allow-scripting or --allow-all. An authenticated attacker can submit long-running...