{"action":"Upgrade SurrealDB to 2.1.9 or later.","affected":[{"fixed":"2.3.8","introduced":"2.3.0"},{"fixed":"2.2.8","introduced":"2.2.0"},{"fixed":"2.1.9","introduced":"0"},{"fixed":"3.0.0-alpha.8","introduced":"3.0.0-alpha.0"}],"component":"SurrealDB","cve_ids":["CVE-2025-11060"],"ecosystem":"crates.io","epss":0.00327,"exploited":false,"fixed_versions":["2.3.8","2.2.8","2.1.9","3.0.0-alpha.8"],"ghsa_id":"GHSA-7vm2-j586-vcvc","id":"tcs_01M5KEVDA5ZVW12X5YY7KC11JT","modified_at":"2025-09-26T17:27:25.248102Z","published_at":"2025-09-11T21:53:23Z","references":["https://osv.dev/vulnerability/GHSA-7vm2-j586-vcvc","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc","https://nvd.nist.gov/vuln/detail/CVE-2025-11060","https://github.com/surrealdb/surrealdb/pull/6247","https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c","https://access.redhat.com/security/cve/CVE-2025-11060","https://bugzilla.redhat.com/show_bug.cgi?id=2394708","https://github.com/surrealdb/surrealdb","https://surrealdb.com/docs/surrealql/statements/live"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-7vm2-j586-vcvc","url":"https://osv.dev/vulnerability/GHSA-7vm2-j586-vcvc"},{"source":"nvd","source_id":"CVE-2025-11060","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11060"}],"summary":"SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions"}