CVE-2026-66838
SQL injection via the :comment option in Postgrex.stream/4
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.
INFO
Published Date :
Aug. 7, 2026, 1:16 p.m.
Last Modified :
Aug. 7, 2026, 1:16 p.m.
Remotely Exploit :
No
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update the postgrex gem to version 0.22.4 or later.
- Ensure the :comment option is properly sanitized.
- Apply security patches to Ecto.Repo.stream/2 usage.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-66838.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-66838 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-66838
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-66838 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-66838 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Aug. 07, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-ecto/postgrex', 'vendor': 'elixir-ecto', 'modules': ["'Elixir.Postgrex'", "'Elixir.Postgrex.Protocol'"], 'product': 'postgrex', 'versions': [{'status': 'affected', 'version': '0.19.3', 'lessThan': '0.22.4', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/postgrex', 'packageName': 'postgrex', 'programFiles': ['lib/postgrex.ex', 'lib/postgrex/protocol.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Postgrex':stream/4"}, {'name': "'Elixir.Postgrex.Protocol':parse_describe_comment_msgs/3"}]}, {'cpes': ['cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-ecto/postgrex', 'vendor': 'elixir-ecto', 'modules': ["'Elixir.Postgrex'", "'Elixir.Postgrex.Protocol'"], 'product': 'postgrex', 'versions': [{'status': 'affected', 'changes': [{'at': 'e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c', 'status': 'unaffected'}, {'at': '4011be852c99dc61ddb98cb01aa41e8775a0e3dd', 'status': 'unaffected'}], 'version': '4971a2722fa72f8e1b54a2c403cad4c43916e36d', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/elixir-ecto/postgrex', 'packageName': 'elixir-ecto/postgrex', 'programFiles': ['lib/postgrex.ex', 'lib/postgrex/protocol.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Postgrex':stream/4"}, {'name': "'Elixir.Postgrex.Protocol':parse_describe_comment_msgs/3"}]}] Added Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4. Added CVSS V4.0 AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-89 Added Reference https://cna.erlef.org/cves/CVE-2026-66838.html Added Reference https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388 Added Reference https://github.com/elixir-ecto/postgrex/commit/4011be852c99dc61ddb98cb01aa41e8775a0e3dd Added Reference https://github.com/elixir-ecto/postgrex/commit/e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-66838