CVE-2026-66838
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An SQL injection vulnerability exists in postgrex (part of elixir-ecto) from 0.19.3 before 0.22.4 via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter and extend the streamed statement with their own clauses.
Risk Assessment
The vulnerability allows execution of unauthorized SQL queries under the connection's role, potentially leading to data integrity issues or unauthorized access.
Recommendation
Update postgrex to version 0.22.4 or later. Also avoid passing untrusted data to the :comment option.
Other vulnerabilities in postgrex
See all- CVE-2026-58225Low
SQL Injection vulnerability in the postgrex library for Elixir allows an attacker to inject SQL via a LISTEN channel name. The issue occurs during reconnection when channel names are concatenated in an anonymous code block, and the quote_channel/1 function does not escape the $$ delimiter, causing the notification connection to break and resulting in denial of service.
- CVE-2026-32687High
An SQL injection vulnerability in the Elixir.Postgrex.Notifications module of the postgrex library for Elixir. The channel argument passed to listen/3 and unlisten/3 is interpolated directly into LISTEN/UNLISTEN SQL statements without escaping the double-quote character. An attacker who can influence the channel name can inject arbitrary SQL commands, including DDL and DML, using the PostgreSQL simple query protocol. This affects versions from 0.16.0 before 0.22.2.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.