Hexpm · Elixir-Ecto · CVE-2026-66838
**Name of the Vulnerable Software and Affected Versions**
postgrex versions 0.19.3 through 0.22.3
**Description**
An SQL Injection issue exists in the postgrex library used by elixir-ecto. The flaw occurs when the `:comment` option is used within the `Postgrex.stream/4` function or the `Ecto.Repo.stream/2` function. An attacker capable of influencing the value of the `:comment` variable can use the `*/` sequence to close the comment delimiter and append unauthorized SQL clauses that execute with the privileges of the connection's role. This happens because the software concatenates the comment into the statement text sent in the Parse message without escaping or rejecting the `*/` sequence, and the `stream/4` function fails to call the `comment not present!/1` validation function used elsewhere. The injection is limited to the streamed statement as the Parse message only accepts a single command.
**Recommendations**
Update postgrex to version 0.22.4 or later.
As a temporary workaround, reject any `:comment` value containing `*/` or a null byte before passing it to `Postgrex.stream/4` or `Ecto.Repo.stream/2`.
Ensure that comments are built only from trusted values.