CVE-2026-32687 Details
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' module) allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and 'Elixir.Postgrex.Notifications':unlisten/3 is interpolated directly into LISTEN "..." / UNLISTEN "..." SQL statements without escaping the " character. An attacker who can influence the channel name can inject a " to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect. This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines 'Elixir.Postgrex.Notifications':listen/3, 'Elixir.Postgrex.Notifications':unlisten/3, 'Elixir.Postgrex.Notifications':handle_connect/1. This issue affects postgrex: from 0.16.0 before 0.22.2.
A SQL injection vulnerability has been identified in the Elixir Postgrex library, specifically within the Notifications module. This issue arises because the channel argument in the listen and unlisten functions is directly inserted into SQL statements without proper escaping. An attacker can exploit this by injecting a quote to escape the identifier and append arbitrary SQL commands. The vulnerability is present in versions 0.16.0 prior to 0.22.2.
Upgrade to Postgrex version 0.22.2 or later. If upgrading is not possible, sanitize channel names to remove quotes and null bytes before passing them to the listen or unlisten functions.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-32687.html | EEF | Third Party Advisory |
| https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h | EEF | Vendor Advisory |
| https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770 | EEF | Patch |
| https://osv.dev/vulnerability/EEF-CVE-2026-32687 | EEF | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-ecto postgrex | >= 0.16.0, < 0.22.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | EEF |