HighGHSA-2rcv-vpjw-5g6c20 Oct · 3 days ago
Source ↗

Unsanitized delimiter injection enables cross-tenant access to private channels.

Does it affect you?

0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

20 Oct
3 daysfrom publication to Patchwire
  1. Published by GitHub advisory20 Oct
  2. Seen by Patchwire23 Oct

Versions in the source

Packages

supabase/realtime

Stacks

Supabase

Related alerts(1)

Same packages

Client-supplied bytes are spliced unvalidated into other subscribers' JSON frames, letting any broadcaster forge Realtime protocol events (including postgres_changes) to every other client on the channel

supabase/realtime · 24 Sep

High
Conditions not read yet

Source summary

Summary The bytes a client sends as a V2 binary user broadcast are spliced verbatim into the JSON text frame that other clients receive, without ever being parsed or validated. Any client that may broadcast on a channel can therefore write arbitrary top-level Realtime protocol fields into the frames every other subscriber on that channel receives, including a forged postgres changes database-change event and a forged phx close . On a public channel no authorization of any kind is involved: the anon key is published in every client bundle by design, and public channels run with policies: nil .

Affected
supabase/realtime <=2.137.14
Fixed in
no fix yet
ID
GHSA-9vjf-j9f7-j42c
Open the alert