CVE-2026-32687
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An SQL injection vulnerability in the Elixir.Postgrex.Notifications module of the postgrex library for Elixir. The channel argument passed to listen/3 and unlisten/3 is interpolated directly into LISTEN/UNLISTEN SQL statements without escaping the double-quote character. An attacker who can influence the channel name can inject arbitrary SQL commands, including DDL and DML, using the PostgreSQL simple query protocol. This affects versions from 0.16.0 before 0.22.2.
Risk Assessment
Risk of remote arbitrary SQL command execution on the PostgreSQL database, potentially compromising data confidentiality, integrity, and availability, including table deletion.
Recommendation
Immediately update the postgrex library to version 0.22.2 or later and avoid passing untrusted data as channel names.
Other vulnerabilities in postgrex
See all- CVE-2026-58225Low
SQL Injection vulnerability in the postgrex library for Elixir allows an attacker to inject SQL via a LISTEN channel name. The issue occurs during reconnection when channel names are concatenated in an anonymous code block, and the quote_channel/1 function does not escape the $$ delimiter, causing the notification connection to break and resulting in denial of service.
- CVE-2026-66838High
An SQL injection vulnerability exists in postgrex (part of elixir-ecto) from 0.19.3 before 0.22.4 via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter and extend the streamed statement with their own clauses.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' module) allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and 'Elixir.Postgrex.Notifications':unlisten/3 is interpolated directly into LISTEN "..." / UNLISTEN "..." SQL statements without escaping the " character. An attacker who can influence the channel name can inject a " to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect. This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines 'Elixir.Postgrex.Notifications':listen/3, 'Elixir.Postgrex.Notifications':unlisten/3, 'Elixir.Postgrex.Notifications':handle_connect/1. This issue affects postgrex: from 0.16.0 before 0.22.2.