Cyber Posture

CVE-2021-47748

CriticalPublic PoC

Published: 21 January 2026

Published
21 January 2026
Modified
02 February 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's…

more

COPY FROM PROGRAM functionality.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Patching Hasura GraphQL to fixed versions directly eliminates the RCE vulnerability exploited via SQL query manipulation.

prevent

Validates GraphQL query inputs to block malicious SQL commands that trigger PostgreSQL's COPY FROM PROGRAM for shell execution.

prevent

Restricts or disables unnecessary Hasura features like the run_sql endpoint to minimize exposure to command injection attacks.

Security SummaryAI

CVE-2021-47748 is a remote code execution vulnerability in Hasura GraphQL version 1.3.3. It enables attackers to execute arbitrary shell commands by manipulating SQL queries through the run_sql endpoint. Specifically, malicious GraphQL queries exploit PostgreSQL's COPY FROM PROGRAM functionality to inject and run system commands, classified under CWE-78 (OS Command Injection) with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants full remote code execution on the host running Hasura GraphQL, potentially allowing complete system compromise including data exfiltration, privilege escalation, or further lateral movement.

Advisories from sources like VulnCheck (https://www.vulncheck.com/advisories/hasura-graphql-remote-code-execution) and an exploit PoC on Exploit-DB (https://www.exploit-db.com/exploits/49802) detail the issue; practitioners should consult the Hasura GraphQL GitHub repository (https://github.com/hasura/graphql-engine) for patch information and upgrade to fixed versions to mitigate.

A public exploit is available, indicating proof-of-concept exploitation is feasible, though no widespread real-world incidents are noted in the provided data.

Details

CWE(s)

Affected Products

hasura
graphql engine
1.3.3

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

CVE enables unauthenticated remote code execution via exploitation of a public-facing GraphQL application (T1190), directly facilitating arbitrary Unix shell command execution through SQL query manipulation and PostgreSQL COPY FROM PROGRAM (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References