AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-07T13:16:52.960Z and has not been modified since then. The NVD entry is currently Analyzed. This SQL injection vulnerability in postgrex allows attackers to inject malicious SQL by manipulating the :comment option in Postgrex.stream/4, affecting postgrex versions from 0.19.3 up to but not including [truncated]
CVE-2026-58225 is a SQL Injection vulnerability in elixir-ecto postgrex. An attacker who can influence a LISTEN channel name can inject SQL into the reconnect replay query, causing a denial of service of the notification connection. The vulnerability affects postgrex versions from 0.16.0 before 0.22.3. This issue has a significant impact on applications that pass untrusted input as a channel name to Postg [truncated]
CVE-2026-32687 is a SQL injection issue in elixir-ecto/postgrex’s notifications handling. If an attacker can influence the channel name passed to LISTEN/UNLISTEN, the value is interpolated into SQL without escaping double quotes, which can break out of the quoted identifier and append additional SQL. The same pattern is also present when reconnect logic replays subscriptions in handle_connect/1.
