SQL Injection in Elixir-ecto Postgrex

CVE-2026-66838

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can clos…

Vulnerability class: SQL Injection

Affected products

Elixir-ecto Postgrex — versions 0.19.3, 4971a2722fa72f8e1b54a2c403cad4c43916e36d

Weakness classification (CWE)

CWE-89 — SQL Injection

References

6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, vendor-advisory)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (patch)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (patch)