CVE-2021-47748

CriticalPublic PoCRCE

Published: 21 January 2026

Published

21 January 2026

Modified

02 February 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0102 58.9th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2021-47748 is a critical-severity OS Command Injection (CWE-78) vulnerability in Hasura Graphql Engine. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2021-47748 is a remote code execution vulnerability in Hasura GraphQL version 1.3.3. It enables attackers to execute arbitrary shell commands by manipulating SQL queries through the run_sql endpoint. Specifically, malicious GraphQL queries exploit PostgreSQL's COPY FROM PROGRAM functionality to inject and run system commands, classified under CWE-78 (OS Command Injection) with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants full remote code execution on the host running Hasura GraphQL, potentially allowing complete system compromise including data exfiltration, privilege escalation, or further lateral movement.

Advisories from sources like VulnCheck (https://www.vulncheck.com/advisories/hasura-graphql-remote-code-execution) and an exploit PoC on Exploit-DB (https://www.exploit-db.com/exploits/49802) detail the issue; practitioners should consult the Hasura GraphQL GitHub repository (https://github.com/hasura/graphql-engine) for patch information and upgrade to fixed versions to mitigate.

A public exploit is available, indicating proof-of-concept exploitation is feasible, though no widespread real-world incidents are noted in the provided data.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3661

Vulnerability details

Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's…

COPY FROM PROGRAM functionality.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

CVE enables unauthenticated remote code execution via exploitation of a public-facing GraphQL application (T1190), directly facilitating arbitrary Unix shell command execution through SQL query manipulation and PostgreSQL COPY FROM PROGRAM (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0