CVE-2026-66838 Details
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.
A SQL injection vulnerability has been identified in the Elixir Ecto Postgrex library, specifically in versions 0.19.3 prior to 0.22.4. The issue arises from improper handling of the ':comment' option in the 'Postgrex.stream/4' method. An attacker who can manipulate this option can close the comment delimiter with '*/' and inject their own SQL clauses, which are executed under the current database connection's role. This vulnerability is also present in 'Ecto.Repo.stream/2', as it forwards the same unvalidated comment option. The injection is limited to the streamed SQL statement, preventing the chaining of additional commands.
The vulnerability has been patched in Postgrex version 0.22.4. To address this issue, update to the latest version. Additionally, applications should reject any ':comment' values containing '*/' or null bytes before passing them to 'Postgrex.stream/4' or 'Ecto.Repo.stream/2'.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388 | CISA-ADP | ExploitPatchVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-66838.html | EEF | PatchThird Party Advisory |
| https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388 | EEF | ExploitPatchVendor Advisory |
| https://github.com/elixir-ecto/postgrex/commit/4011be852c99dc61ddb98cb01aa41e8775a0e3dd | EEF | Patch |
| https://github.com/elixir-ecto/postgrex/commit/e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c | EEF | Patch |
| https://osv.dev/vulnerability/EEF-CVE-2026-66838 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-ecto postgrex | >= 0.19.3, < 0.22.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | Initial Analysis | [email protected] |
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | EEF |