PT-2026-3794 · Hasura · Hasura Graphql

Dolev Farhi · Publicado 2026-01-21 · Atualizado 2026-01-26 · CVE-2021-47748

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hasura GraphQL version 1.3.3

Description Hasura GraphQL version 1.3.3 contains a remote code execution issue. Attackers can execute arbitrary shell commands through SQL query manipulation. The issue allows command injection into the run sql endpoint by crafting malicious GraphQL queries. Exploitation involves using PostgreSQL's COPY FROM PROGRAM functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2021-47748

Produtos afetados

Hasura Graphql

Referências · 7

• 🔥 https://exploit-db.com/exploits/49802 · Exploit
• https://github.com/hasura/graphql-engine · Nota
• https://vulncheck.com/advisories/hasura-graphql-remote-code-execution · Nota
• https://osv.dev/vulnerability/CVE-2021-47748 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2014034338174701799 · Publicação no Twitter
• https://twitter.com/cracbot/status/2015741572181352742 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2021-47748 · Nota de Segurança