CVE-2026-66838 Elixir Ecto CVE debrief

Who should care

Developers and administrators using postgrex within the Elixir Ecto ecosystem should be aware of this vulnerability. Specifically, anyone using postgrex versions from 0.19.3 up to but not including 0.22.4 is at risk and should take action to mitigate the vulnerability.

Technical summary

The CVE-2026-66838 vulnerability is caused by improper neutralization of special elements used in SQL commands in the postgrex library. Specifically, the :comment option in Postgrex.stream/4 can be exploited to inject SQL by an attacker who can influence that value. This is achieved by closing the comment delimiter with */ and extending the streamed statement with additional clauses, which execute under the connection's role. The vulnerability affects postgrex versions from 0.19.3 up to but not including 0.22.4.

Defensive priority

Organizations using postgrex from version 0.19.3 up to but not including 0.22.4 should prioritize patching to prevent potential SQL injection attacks.

Recommended defensive actions

• Inventory and verify the version of postgrex in use, checking if it falls within the vulnerable range (from 0.19.3 up to but not including 0.22.4).
• Apply the patch or upgrade to postgrex version 0.22.4 or later.
• Implement compensating controls such as input validation and sanitization for SQL queries.
• Monitor for suspicious SQL query patterns that could indicate attempted exploitation.
• Consider using Ecto.Repo.stream/2 as it also exposes the :comment option but may offer different security characteristics.

Evidence notes

The CVE-2026-66838 issue arises from improper neutralization of special elements in SQL commands, specifically within the postgrex library's handling of the :comment option in Postgrex.stream/4. This allows attackers to inject SQL by closing the comment delimiter and appending their own clauses. The vulnerability affects postgrex versions from 0.19.3 up to but not including 0.22.4.

Official resources