CVE-2026-66838

CVE-2026-66838 is a SQL injection (CWE-89) in the Elixir PostgreSQL driver Postgrex, affecting versions from 0.19.3 up to but not including 0.22.4. The flaw arises because Postgrex.stream/4 embeds the caller-supplied :comment option into the statement text of the Parse message by raw concatenation, without invoking the comment_not_present!/1 validation applied at every other execution point, so an attacker who can influence that value can close the comment with */ and append their own SQL clauses, which execute under the database connection's role. Applications that pass attacker-controlled data as :comment — including through Ecto.Repo.stream/2, which exposes the same option — are affected; because Parse accepts only a single command, the injection is confined to the streamed statement and further statements cannot be chained. CVSS 4.0 rates this 5.9 (medium) with a precondition that the attacker has a way to influence the comment value, and no exploitation in the wild is currently known (EPSS 0.3%, not in CISA KEV), though a public advisory with a proof-of-concept exists (GHSA-3gww-3f36-2388).

What to do: Upgrade postgrex to 0.22.4 or later via your dependency manager, and review the public advisory GHSA-3gww-3f36-2388. If you cannot upgrade immediately, audit whether your code calls Postgrex.stream/4 or Ecto.Repo.stream/2 with a :comment option and, if so, ensure that value never originates from untrusted input or sanitize it to reject the */ sequence. Because exploitation requires application code to forward attacker-influenced data into :comment, checking that single call pattern is the fastest way to determine actual exposure.