| Package | Affected versions | Patched versions |
|---|---|---|
| graphql engine | = 1.3.3 |
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free