CVE-2021-47748
Published: 21 January 2026
Description
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's…
more
COPY FROM PROGRAM functionality.
Mitigating Controls (NIST 800-53 r5)AI
Patching Hasura GraphQL to fixed versions directly eliminates the RCE vulnerability exploited via SQL query manipulation.
Validates GraphQL query inputs to block malicious SQL commands that trigger PostgreSQL's COPY FROM PROGRAM for shell execution.
Restricts or disables unnecessary Hasura features like the run_sql endpoint to minimize exposure to command injection attacks.
Security SummaryAI
CVE-2021-47748 is a remote code execution vulnerability in Hasura GraphQL version 1.3.3. It enables attackers to execute arbitrary shell commands by manipulating SQL queries through the run_sql endpoint. Specifically, malicious GraphQL queries exploit PostgreSQL's COPY FROM PROGRAM functionality to inject and run system commands, classified under CWE-78 (OS Command Injection) with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants full remote code execution on the host running Hasura GraphQL, potentially allowing complete system compromise including data exfiltration, privilege escalation, or further lateral movement.
Advisories from sources like VulnCheck (https://www.vulncheck.com/advisories/hasura-graphql-remote-code-execution) and an exploit PoC on Exploit-DB (https://www.exploit-db.com/exploits/49802) detail the issue; practitioners should consult the Hasura GraphQL GitHub repository (https://github.com/hasura/graphql-engine) for patch information and upgrade to fixed versions to mitigate.
A public exploit is available, indicating proof-of-concept exploitation is feasible, though no widespread real-world incidents are noted in the provided data.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated remote code execution via exploitation of a public-facing GraphQL application (T1190), directly facilitating arbitrary Unix shell command execution through SQL query manipulation and PostgreSQL COPY FROM PROGRAM (T1059.004).