CVE-2026-66838: SQL injection via the :comment option in Postgrex.stream/4
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2.
Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting /. The option is validated by commentnotpresent!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.
This issue affects postgrex: from 0.19.3 before 0.22.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66838?
CVE-2026-66838 has a risk rating of 56, indicating a moderate severity level.
How do I fix CVE-2026-66838?
To fix CVE-2026-66838, ensure that input passed to the :comment option in Postgrex.stream/4 is properly sanitized to prevent SQL injection.
What products are affected by CVE-2026-66838?
CVE-2026-66838 affects the elixir-ecto Postgrex library used in Elixir applications.
What type of vulnerability is CVE-2026-66838?
CVE-2026-66838 is classified as an SQL Injection vulnerability.
Can an attacker exploit CVE-2026-66838 remotely?
Yes, an attacker can exploit CVE-2026-66838 remotely if they can influence the value passed to the :comment option.