The vulnerability is an SQL injection flaw in the Elixir Ecto Postgrex notifications module. The listen/3 and unlisten/3 functions interpolate the supplied channel name directly into a LISTEN or UNLISTEN statement without escaping double-quote characters, allowing an attacker who can influence the channel name to inject a \" to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, enabling DDL and DML commands to be chained. The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect. The flaw is classified as a CWE-89 vulnerability.

Any deployment of Elixir Ecto Postgrex prior to version 0.22.2 is vulnerable. This includes the 0.16.0‑0.22.2 range mentioned in the advisory, regardless of GitHub commit tag. Systems using these versions that allow untrusted code or user input to dictate notification channel names are affected. The vulnerability exists in the lib/postgrex/notifications.ex source file and is triggered through the Elixir.Postgrex.Notifications module.

The advisory assigns a CVSS score of 7.5, indicating high severity, and the EPSS score is < 1%, while the issue is not listed in the CISA KEV database. The attack is feasible in environments where the application exposes channel names to external actors; the simple query protocol permits multiple statements, making the risk tangible. Exploitation requires no special hardware or advanced techniques beyond the ability to send constructed channel names, thus a determined attacker with application access could immediately trigger destructive actions on the database.