SQL Injection Vulnerability in Elixir Postgrex Notifications by Elixir

CVE-2026-32687

What is CVE-2026-32687?

The vulnerability in Elixir's Postgrex Notifications module arises from improper handling of user-supplied channel names, allowing attackers to inject malicious SQL commands. When the channel argument is directly interpolated into LISTEN and UNLISTEN SQL statements, it creates an opportunity for SQL Injection. This flaw enables an attacker to execute arbitrary SQL statements, which can include destructive actions like dropping tables. Additionally, a similar issue occurs during the reconnection process where LISTEN commands are replayed, further amplifying the potential risk.

References