Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2.

Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.

This issue affects postgrex: from 0.19.3 before 0.22.4.
Published: 2026-08-07
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Postgrex allows an attacker who can supply a comment string to craft an invalid comment delimiter and inject arbitrary SQL clauses into the streamed statement. The injected code runs under the connection’s role and can modify data, create or drop tables, or otherwise compromise the database. The vulnerability is a classic SQL Injection flaw (CWE‑89) and is not a full/automatic escalation of permissions; it is limited to the statement being streamed.

Affected Systems

Affected systems include the Elixir‑Ecto Postgrex library in any releases from 0.19.3 up to, but not including, 0.22.4. The same issue is present in Ecto when using Ecto.Repo.stream/2, which forwards the comment option to Postgrex. The CPE string identifies the generic “postgrex” product.

Risk and Exploitability

The CVSS base score of 5.9 indicates a medium severity vulnerability. No EPSS value is available, and the flaw is not listed in the CISA KEV catalog. An attacker needs to influence the :comment option supplied to Postgrex.stream/4 or Ecto.Repo.stream/2, a capability that is typically available to code executing within the application. The attack surface is therefore contingent on the application allowing untrusted input to reach the function.

Generated by OpenCVE AI on August 7, 2026 at 13:50 UTC.

Remediation

Vendor Workaround

Reject any :comment value containing */ or a null byte before passing it to Postgrex.stream/4 or Ecto.Repo.stream/2. Alternatively, build comments only from trusted values.

OpenCVE Recommended Actions

  • Upgrade Postgrex to version 0.22.4 or later
  • Upgrade Ecto to the newest release to ensure the comment option is validated
  • If an upgrade is not feasible, filter any :comment value containing "*/" or a null byte before passing it to Postgrex.stream/4 or Ecto.Repo.stream/2, or construct comments solely from trusted data

Generated by OpenCVE AI on August 7, 2026 at 13:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

Fri, 07 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.
Title SQL injection via the :comment option in Postgrex.stream/4
First Time appeared Elixir-ecto
Elixir-ecto postgrex
Weaknesses CWE-89
CPEs cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*
Vendors & Products Elixir-ecto
Elixir-ecto postgrex
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Elixir-ecto Postgrex
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-07T15:12:12.308Z

Reserved: 2026-08-06T14:00:01.865Z

Link: CVE-2026-66838

cve-icon Vulnrichment

Updated: 2026-08-07T15:12:07.776Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-07T13:16:52.960

Modified: 2026-08-17T14:40:45.317

Link: CVE-2026-66838

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T16:00:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')