PT-2026-3794 · Hasura · Hasura Graphql

Dolev Farhi · CVE-2021-47748 · Published 2026-01-21 · Updated 2026-01-26

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hasura GraphQL version 1.3.3

Description Hasura GraphQL version 1.3.3 contains a remote code execution issue. Attackers can execute arbitrary shell commands through SQL query manipulation. The issue allows command injection into the run sql endpoint by crafting malicious GraphQL queries. Exploitation involves using PostgreSQL's COPY FROM PROGRAM functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-47748

Affected Products

Hasura Graphql

References · 7

• 🔥 https://exploit-db.com/exploits/49802 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47748 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47748 · Vendor Advisory
• https://github.com/hasura/graphql-engine · Note
• https://vulncheck.com/advisories/hasura-graphql-remote-code-execution · Note
• https://twitter.com/0dayPublishing/status/2014034338174701799 · Twitter Post
• https://twitter.com/cracbot/status/2015741572181352742 · Twitter Post