CVE-2021-47748 Details
Description
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality.
A remote code execution vulnerability exists in Hasura GraphQL version 1.3.3. This issue allows attackers to execute arbitrary shell commands by manipulating SQL queries. The vulnerability is exploited through the run_sql endpoint, where crafted GraphQL queries can inject commands that are executed via PostgreSQL's COPY FROM PROGRAM functionality.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hasura/graphql-engine | [email protected] | Product |
| https://www.exploit-db.com/exploits/49802 | [email protected] | Exploit |
| https://www.vulncheck.com/advisories/hasura-graphql-remote-code-execution | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hasura graphql engine | 1.3.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 2, 2026 | Initial Analysis | [email protected] |
| Jan 21, 2026 | New CVE Received | [email protected] |