postgrex vulnerabilities

SQL Injection vulnerability in the postgrex library for Elixir allows an attacker to inject SQL via a LISTEN channel name. The issue occurs during reconnection when channel names are concatenated in an anonymous code block, and the quote_channel/1 function does not escape the $$ delimiter, causing the notification connection to break and resulting in denial of service.

An SQL injection vulnerability exists in postgrex (part of elixir-ecto) from 0.19.3 before 0.22.4 via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter and extend the streamed statement with their own clauses.

An SQL injection vulnerability in the Elixir.Postgrex.Notifications module of the postgrex library for Elixir. The channel argument passed to listen/3 and unlisten/3 is interpolated directly into LISTEN/UNLISTEN SQL statements without escaping the double-quote character. An attacker who can influence the channel name can inject arbitrary SQL commands, including DDL and DML, using the PostgreSQL simple query protocol. This affects versions from 0.16.0 before 0.22.2.