GCVE - cpe:2.3:a:hasura:graphql_engine:1.3.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:hasura:graphql_engine:1.3.3:*:*:*:*:*:*:*

part: a version: 1.3.3 update: *

Vendor	Hasura (`06d0bbac-ff6d-5740-8bd3-432231a37a86`)
Product	Graphql Engine (`638d8014-b2f8-5df5-9652-9e813bcf30cf`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/hasura/graphql-engine`	purl2cpe	2026-06-01 10:11:06.311762
`pkg:github/hasura/graphql-engine`	purl2cpe	2026-06-01 10:11:06.311764

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-47748`	vulnerable	2026-06-08 05:38:07.566184	Hasura GraphQL 1.3.3 - Remote Code Execution CRITICAL (9.8) Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality. Published: 2026-01-21T17:27:31.545Z Updated: 2026-07-28T01:47:19.543Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49802 https://github.com/hasura/graphql-engine https://www.vulncheck.com/advisories/hasura-graphql-remote-code-execution	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-47715`	vulnerable	2026-06-08 05:38:07.449091	Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection MEDIUM (5.3) Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources. Published: 2025-12-22T21:35:25.534Z Updated: 2026-08-14T16:49:18.458Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49791 https://github.com/hasura/graphql-engine https://www.vulncheck.com/advisories/hasura-graphql-server-side-request-forgery-via-remote-schema-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-47714`	vulnerable	2026-06-08 05:38:07.448541	Hasura GraphQL 1.3.3 Local File Read via SQL Injection MEDIUM (5.5) Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server. Published: 2025-12-22T21:35:25.094Z Updated: 2026-08-14T16:49:17.771Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49790 https://github.com/hasura/graphql-engine https://www.vulncheck.com/advisories/hasura-graphql-local-file-read-via-sql-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-47713`	vulnerable	2026-06-08 05:38:07.447983	Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query HIGH (7.5) Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields. Attackers can send repeated requests with extremely long query strings and multiple threads to consume server resources and potentially crash the GraphQL endpoint. Published: 2025-12-22T21:35:24.561Z Updated: 2026-08-14T16:49:17.118Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49789 https://github.com/hasura/graphql-engine https://www.vulncheck.com/advisories/hasura-graphql-denial-of-service-via-malicious-graphql-query	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.