supabase/realtime has 2 advisories. Version not read yet.

Details

You run
not in lockfile
Safe
no fixed version
Advisories
2 in 120 days

Used by

Stacks that pull this package.

Supabase

Alerts(2)

Unsanitized delimiter injection enables cross-tenant access to private channels

supabase/realtime · 20 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Self-hosted Supabase Realtime deployment serving multiple tenants.
  • Clients or users can choose their own tenant external id (e.g. user-defined project names) through the management API.
  • An attacker can create a tenant whose external id equals the victim's tenant id followed by "-private".
  • The victim tenant uses private (RLS-protected) broadcast channels.
Affected
in the source
Fixed in
no fix yet
ID
GHSA-2rcv-vpjw-5g6c
Open the alert

Client-supplied bytes are spliced unvalidated into other subscribers' JSON frames, letting any broadcaster forge Realtime protocol events (including postgres_changes) to every other client on the channel

supabase/realtime · 24 Sep

High
Exploitable only if · read by Claude, the source remains the reference
  • Runs Supabase Realtime v2.137.x (e.g. v2.137.14) with the V2 binary serializer.
  • Attacker can broadcast on the channel: any client with the anon key on a public channel, or broadcast write under RLS on a private channel.
  • Victim subscribers on the same channel connect with the V1 JSON serializer (vsn=1.0.0).
Affected
supabase/realtime <=2.137.14
Fixed in
no fix yet
ID
GHSA-9vjf-j9f7-j42c
Open the alert