Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-6wqw-vhfr-9999
No affected components available
A record user could read records the table's SELECT permission expression should have hidden, when that expression referenced $value, $before, $after, or $event. Binding a chosen value to that name before registering a LIVE SELECT caused notifications to evaluate the permission against the attacker's input instead of the real document.
Impact
A record user binds a value to $value, $before, $after, or $event (e.g. LET $value = [$auth.id]) and registers LIVE SELECT * FROM person. The captured value shadows the real document at notification time, so a SELECT permission like WHERE $auth.id.id() IN $value passes for every record on the table — the subscriber receives notifications for records they should not see.
Read-only impact, bounded to one table. Permission expressions that reference only field names, $auth, or $session are unaffected.
Patches
A patch has been introduced that re-orders the LIVE notification parameter binding so captured user variables are added first and the trusted document-context and session parameters are added last.
- Versions 3.1.0 and later are not affected by this issue.
Workarounds
Affected users who are unable to update should avoid table-PERMISSIONS and LIVE WHERE expressions that read user-named variables ($value, $before, $after, $event) without also gating on a system-derived field such as the record id.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the confidentiality of the information.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard