@powersync vulnerabilities

Products

• service-core 1
• service-sync-rules 1

Latest @powersync CVEs

Newest publication first

1. CVE-2026-30870 Some sync filters in PowerSync Service ignored using `config.edition: 3`

   Published 2026-03-09

   Medium·CVSS 6.5

   PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.