Stack & Platforms: burning. A critical or high issue has no fix yet.

Vercel
0CalmQuiet month
Supabase
2Fix outFix available
Cloudflare Workers
0CalmQuiet month
Railway
0CalmQuiet month
Neon
0CalmQuiet month
PostgreSQL
0CalmQuiet month
Clerk
0CalmQuiet month

Alerts(2)

Sorted by severity

Unsanitized delimiter injection enables cross-tenant access to private channels

supabase/realtime · 20 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Self-hosted Supabase Realtime deployment serving multiple tenants.
  • Clients or users can choose their own tenant external id (e.g. user-defined project names) through the management API.
  • An attacker can create a tenant whose external id equals the victim's tenant id followed by "-private".
  • The victim tenant uses private (RLS-protected) broadcast channels.
Affected
in the source
Fixed in
no fix yet
ID
GHSA-2rcv-vpjw-5g6c
Open the alert

Client-supplied bytes are spliced unvalidated into other subscribers' JSON frames, letting any broadcaster forge Realtime protocol events (including postgres_changes) to every other client on the channel

supabase/realtime · 24 Sep

High
Conditions not read yet

Source summary

Summary The bytes a client sends as a V2 binary user broadcast are spliced verbatim into the JSON text frame that other clients receive, without ever being parsed or validated. Any client that may broadcast on a channel can therefore write arbitrary top-level Realtime protocol fields into the frames every other subscriber on that channel receives, including a forged postgres changes database-change event and a forged phx close . On a public channel no authorization of any kind is involved: the anon key is published in every client bundle by design, and public channels run with policies: nil .

Affected
supabase/realtime <=2.137.14
Fixed in
no fix yet
ID
GHSA-9vjf-j9f7-j42c
Open the alert