Is SurrealDB's MCP server patched against the backtick statement injection?

SurrealDB patched the MCP identifier flaw in version 4.0.0, the only release line the advisory lists as unaffected. The fix, commit ec41ae8f15, rewrites consume_backtick_ident so the validator scans identifiers the way the SurrealQL lexer does and treats a backslash as escaping the next byte. Every version below 4.0.0 remains affected, so upgrading is the action.

Which SurrealDB versions are affected by GHSA-cr79-9p8r-p5wx?

GHSA-cr79-9p8r-p5wx affects every SurrealDB release below 4.0.0, according to SurrealDB's advisory, which names the vulnerable package as surrealdb on Cargo. SurrealDB does not record a backported fix for the 3.x line in the advisory. Operators who cannot move to the 4.0.0 major release should weigh whether the MCP server integration needs to be reachable at all.

How does an attacker reach the SurrealDB MCP injection flaw?

Reaching the flaw requires supplying an identifier that contains a backslash-escaped backtick through an MCP tool call, as SurrealDB's advisory describes. The advisory states the result is arbitrary SQL execution through MCP tool invocation and a bypass of the tool's argument constraints. SurrealDB places the defect in the MCP server's identifier validation rather than in the SurrealQL parser.

MEDVulnerability

SurrealDB: an escaped backtick in an MCP tool call runs any query

SurrealDB's MCP server let a backslash-escaped backtick in a tool argument close an identifier early and run attacker SurrealQL.

November 3, 2026 · SurrealDB · Research by ARSB

SurrealDB

MEDVulnerability

SurrealDB's MCP server accepted a backslash-escaped backtick as the end of an identifier, letting attacker input run as raw SurrealQL through MCP tool calls. SurrealDB fixed the flaw in version 4.0.0 and credits ARSB.

01What happened

SurrealDB published advisory GHSA-cr79-9p8r-p5wx on November 3, 2026, describing a statement injection flaw in its Model Context Protocol server integration. SurrealDB credits ARSB with reporting the issue and lists 4.0.0 as the patched version. The advisory arrived in a batch of SurrealDB advisories published the same day.

02How it works

The MCP server validates tool identifiers with its own parser, which treats the first backtick it sees as the closing delimiter even when a backslash precedes it. SurrealQL's lexer instead reads a backslash-escaped backtick as a literal character inside the identifier. Because the two components disagree, an identifier carrying an escaped backtick looks closed to the validator but not to the database, and the rest of the input is read as raw SurrealQL. SurrealDB places the defect in consume_backtick_ident and validate_identifier in surrealdb/mcp/src/tools/mod.rs.

03Who is affected

Deployments running SurrealDB's MCP server below version 4.0.0 are exposed, as the advisory states. Exploiting the flaw needs the ability to supply an identifier in a SurrealDB MCP tool call. SurrealDB installations that do not expose the MCP server integration fall outside this advisory.

04What to do

Upgrade SurrealDB to 4.0.0 or later, the version the advisory names as patched. For anyone maintaining a similar tool layer, SurrealDB recommends aligning identifier parsing with the core SurrealQL lexer, or building queries from parameterized AST nodes instead of string interpolation.

Questions people ask

Is SurrealDB's MCP server patched against the backtick statement injection?: SurrealDB patched the MCP identifier flaw in version 4.0.0, the only release line the advisory lists as unaffected. The fix, commit ec41ae8f15, rewrites consume_backtick_ident so the validator scans identifiers the way the SurrealQL lexer does and treats a backslash as escaping the next byte. Every version below 4.0.0 remains affected, so upgrading is the action.
Which SurrealDB versions are affected by GHSA-cr79-9p8r-p5wx?: GHSA-cr79-9p8r-p5wx affects every SurrealDB release below 4.0.0, according to SurrealDB's advisory, which names the vulnerable package as surrealdb on Cargo. SurrealDB does not record a backported fix for the 3.x line in the advisory. Operators who cannot move to the 4.0.0 major release should weigh whether the MCP server integration needs to be reachable at all.
How does an attacker reach the SurrealDB MCP injection flaw?: Reaching the flaw requires supplying an identifier that contains a backslash-escaped backtick through an MCP tool call, as SurrealDB's advisory describes. The advisory states the result is arbitrary SQL execution through MCP tool invocation and a bypass of the tool's argument constraints. SurrealDB places the defect in the MCP server's identifier validation rather than in the SurrealQL parser.

Sources 3 links, all fetched

1github.comSurrealDB Advisory
2github.comFix Commit
3github.comSurrealDB 4.0.0 Release