CVE-2021-47748

Hasura GraphQL 1.3.3 - Remote Code Execution

CVSS 9.3 CRITICALEPSS 1.0%CWE-78

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 1.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

21 Jan 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Hasura · GraphQL

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/49802unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/hasura/graphql-engine https://www.exploit-db.com/exploits/49802 https://www.vulncheck.com/advisories/hasura-graphql-remote-code-execution