SQL Injection Vulnerability in Elixir-Ecto Postgrex Affects Data Security

CVE-2026-66838

What is CVE-2026-66838?

A vulnerability in Elixir-Ecto's Postgrex allows attackers to execute SQL Injection via the ':comment' option in Postgrex.stream/4. This flaw occurs because the comment delimiter '*/' can be improperly neutralized, enabling unauthorized SQL commands to be executed under the connection's role. Specifically, the streamed SQL statement can be manipulated as Postgrex concatenates the comment directly into the command without proper escaping. Although the framework attempts to validate this option in other contexts, the validation is bypassed in this streaming function. As a result, attackers could exploit this oversight in versions 0.19.3 up to but not including 0.22.4.

References