Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. At…

CVE-2021-47748 is a remote code execution vulnerability in Hasura GraphQL 1.3.3 that allows attackers to execute arbitrary shell commands through SQL query manipulation. The vulnerability is exploited by injecting malicious commands into the run_sql endpoint through crafted GraphQL queries. Attackers leverage PostgreSQL's COPY FROM PROGRAM functionality to execute system commands. This represents a critical security flaw that provides complete system compromise capabilities to remote attackers.