CVE-2026-66838

Name of the Vulnerable Software and Affected Versions postgrex versions 0.19.3 through 0.22.3

Description An SQL Injection issue exists in the postgrex library used by elixir-ecto. The flaw occurs when the :comment option is used within the Postgrex.stream/4 function or the Ecto.Repo.stream/2 function. An attacker capable of influencing the value of the :comment variable can use the */ sequence to close the comment delimiter and append unauthorized SQL clauses that execute with the privileges of the connection's role. This happens because the software concatenates the comment into the statement text sent in the Parse message without escaping or rejecting the */ sequence, and the stream/4 function fails to call the comment not present!/1 validation function used elsewhere. The injection is limited to the streamed statement as the Parse message only accepts a single command.

Recommendations Update postgrex to version 0.22.4 or later. As a temporary workaround, reject any :comment value containing */ or a null byte before passing it to Postgrex.stream/4 or Ecto.Repo.stream/2. Ensure that comments are built only from trusted values.