Supabase security alerts

⌘K

Supabase: fix available. Version unknown.

Last 30 days

2No criticalFix available

Safe versions

No fixed version published.

Your project

@supabase/supabase-js is not in your saved lockfile.

@supabase/ssrnot in lockfile @supabase/auth-jsnot in lockfile @supabase/realtime-jsnot in lockfile supabasenot in lockfile supabase/realtimenot in lockfile

Alerts⁽²⁾

Sorted by severity

Unsanitized delimiter injection enables cross-tenant access to private channels

supabase/realtime · 20 Oct

High

Exploitable only if · read by Claude, the source remains the reference

Self-hosted Supabase Realtime deployment serving multiple tenants.
Clients or users can choose their own tenant external id (e.g. user-defined project names) through the management API.
An attacker can create a tenant whose external id equals the victim's tenant id followed by "-private".
The victim tenant uses private (RLS-protected) broadcast channels.

Affected: in the source
Fixed in: no fix yet
ID: GHSA-2rcv-vpjw-5g6c

Open the alert

Client-supplied bytes are spliced unvalidated into other subscribers' JSON frames, letting any broadcaster forge Realtime protocol events (including postgres_changes) to every other client on the channel

supabase/realtime · 24 Sep

High

Conditions not read yet

Source summary

Summary The bytes a client sends as a V2 binary user broadcast are spliced verbatim into the JSON text frame that other clients receive, without ever being parsed or validated. Any client that may broadcast on a channel can therefore write arbitrary top-level Realtime protocol fields into the frames every other subscriber on that channel receives, including a forged postgres changes database-change event and a forged phx close . On a public channel no authorization of any kind is involved: the anon key is published in every client bundle by design, and public channels run with policies: nil .

Affected: supabase/realtime <=2.137.14
Fixed in: no fix yet
ID: GHSA-9vjf-j9f7-j42c

Open the alert