Vulnerabilities

CVE-2026-66838 is a SQL injection (CWE-89) in the Elixir PostgreSQL driver Postgrex, affecting versions from 0.19.3 up to but not including 0.22.4. The flaw arises because Postgrex.stream/4 embeds the caller-supplied :comment option into the statement text of the Parse message by raw concatenation, without invoking the comment_not_present!/1 validation applied at every other execution point, so an attacker who can influence that value can close the comment with */ and append their own SQL clauses, which execute under the database connection's role. Applications that pass attacker-controlled data as :comment — including through Ecto.Repo.stream/2, which exposes the same option — are affected; because Parse accepts only a single command, the injection is confined to the streamed statement and further statements cannot be chained. CVSS 4.0 rates this 5.9 (medium) with a precondition that the attacker has a way to influence the comment value, and no exploitation in the wild is currently known (EPSS 0.3%, not in CISA KEV), though a public advisory with a proof-of-concept exists (GHSA-3gww-3f36-2388).

Do: Upgrade postgrex to 0.22.4 or later via your dependency manager, and review the public advisory GHSA-3gww-3f36-2388. If you cannot upgrade immediately, audit whether your code calls Postgrex.stream/4 or Ecto.Repo.stream/2 with a :comment option and, if so, ensure that value never originates from untrusted input or sanitize it to reject the */ sequence. Because exploitation requires application code to forward attacker-influenced data into :comment, checking that single call pattern is the fastest way to determine actual exposure.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' module) allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and 'Elixir.Postgrex.Notifications':unlisten/3 is interpolated directly into LISTEN "..." / UNLISTEN "..." SQL statements without escaping the " character. An attacker who can influence the channel name can inject a " to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect. This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines 'Elixir.Postgrex.Notifications':listen/3, 'Elixir.Postgrex.Notifications':unlisten/3, 'Elixir.Postgrex.Notifications':handle_connect/1. This issue affects postgrex: from 0.16.0 before 0.22.2.