5.9
MEDIUM CVSS 4.0
CVE-2026-66838
SQL injection via the :comment option in Postgrex.stream/4
Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.

INFO

Published Date :

Aug. 7, 2026, 1:16 p.m.

Last Modified :

Aug. 7, 2026, 1:16 p.m.

Remotely Exploit :

No

Source :

6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Affected Products

The following products are affected by CVE-2026-66838 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Elixir-ecto postgrex
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 4.0 MEDIUM 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS 4.0 MEDIUM 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Solution
Update postgrex to version 0.22.4 or later to fix SQL injection via the :comment option.
  • Update the postgrex gem to version 0.22.4 or later.
  • Ensure the :comment option is properly sanitized.
  • Apply security patches to Ecto.Repo.stream/2 usage.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-66838 is associated with the following CWEs:

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-66838 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-66838 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

    Aug. 07, 2026

    Action Type Old Value New Value
    Added Affected [{'cpes': ['cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-ecto/postgrex', 'vendor': 'elixir-ecto', 'modules': ["'Elixir.Postgrex'", "'Elixir.Postgrex.Protocol'"], 'product': 'postgrex', 'versions': [{'status': 'affected', 'version': '0.19.3', 'lessThan': '0.22.4', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/postgrex', 'packageName': 'postgrex', 'programFiles': ['lib/postgrex.ex', 'lib/postgrex/protocol.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Postgrex':stream/4"}, {'name': "'Elixir.Postgrex.Protocol':parse_describe_comment_msgs/3"}]}, {'cpes': ['cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-ecto/postgrex', 'vendor': 'elixir-ecto', 'modules': ["'Elixir.Postgrex'", "'Elixir.Postgrex.Protocol'"], 'product': 'postgrex', 'versions': [{'status': 'affected', 'changes': [{'at': 'e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c', 'status': 'unaffected'}, {'at': '4011be852c99dc61ddb98cb01aa41e8775a0e3dd', 'status': 'unaffected'}], 'version': '4971a2722fa72f8e1b54a2c403cad4c43916e36d', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/elixir-ecto/postgrex', 'packageName': 'elixir-ecto/postgrex', 'programFiles': ['lib/postgrex.ex', 'lib/postgrex/protocol.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Postgrex':stream/4"}, {'name': "'Elixir.Postgrex.Protocol':parse_describe_comment_msgs/3"}]}]
    Added Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.
    Added CVSS V4.0 AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-89
    Added Reference https://cna.erlef.org/cves/CVE-2026-66838.html
    Added Reference https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388
    Added Reference https://github.com/elixir-ecto/postgrex/commit/4011be852c99dc61ddb98cb01aa41e8775a0e3dd
    Added Reference https://github.com/elixir-ecto/postgrex/commit/e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c
    Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-66838
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.