A SQL injection vulnerability was discovered and fixed in Plasmic’s PostgreSQL/Supabase integration on 2026-06-13. This vulnerability allowed execution of arbitrary SQL in users’ connected databases (NOT the Plasmic platform’s databases). We deployed the fix that same day at 18:24 UTC.
Our access logs for this integration are retained for 30 days, and we found no evidence of abuse within that window.
We have emailed users who were affected by this vulnerability. As a precaution, we advise users to rotate any database credentials shared with Plasmic and scope them to the least privilege necessary. Users self-hosting Plasmic should pull in the fix as soon as possible.
If you have any reason to think your database was accessed, email us right away at security@plasmic.app — we’ll help however we can.
Affected databases
PostgreSQL/Supabase integrations allowed SQL injection via the “Query for rows” operation when either the “Filters” or “Sort by” field was left unset. When creating a new operation, the “Sort by” field defaults to unset.
Technical details
The operation editor (depicted above) allows users to build a SQL query template. This operation can be invoked via the /execute endpoint using its operation ID. Any values set in the operation editor are baked into the resulting SQL query, but if unset, an attacker could supply request arguments that would be injected into the WHERE and/or ORDER BY clauses. If a value was an expression with a dynamic binding, those request arguments were properly sanitized.
The fix was merged in this commit.
Credits
Thank you GeoChen for his responsible disclosure.