Critical severity9.8OSV Advisory· Published Jan 21, 2026· Updated Jun 17, 2026
CVE-2021-47748
CVE-2021-47748
Description
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3v1.0.0-alpha0, v1.0.0-alpha01, v1.0.0-alpha02, …+ 2 more
- (no CPE)range: v1.0.0-alpha0, v1.0.0-alpha01, v1.0.0-alpha02, …
- cpe:2.3:a:hasura:graphql_engine:1.3.3:*:*:*:*:*:*:*
- (no CPE)range: <=1.3.3
Patches
Vulnerability mechanics
References
2- www.exploit-db.com/exploits/49802nvdExploit
- www.vulncheck.com/advisories/hasura-graphql-remote-code-executionnvdThird Party Advisory
News mentions
0No linked articles in our index yet.