PT-2026-34173 · Unknown+1 · Electricsql+1

Osidb Bzimport · CVE-2026-40906 · Published 2026-04-21 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electric versions 1.1.12 through 1.4.x

Description The '/v1/shape' API in ElectricSQL contains an error-based SQL injection flaw. This occurs when the order by parameter is processed, allowing an authenticated user to execute crafted ORDER BY expressions to read, write, and destroy the entire contents of the underlying PostgreSQL database.

Recommendations Update to version 1.5.0. As a temporary workaround, restrict or avoid using the order by parameter in the '/v1/shape' API endpoint until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-40906

GHSA-H5RG-PXX7-R2HJ

Affected Products

Electricsql

Postgresql

References · 12

• 🔥 https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj · Exploit
• 🔥 https://github.com/electric-sql/electric/pull/4081 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40906.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40906 · Security Note
• https://twitter.com/0dayPublishing/status/2046686633076969634 · Twitter Post
• https://twitter.com/CVEnew/status/2048910148526313509 · Twitter Post
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40906.json · Note
• https://twitter.com/the_yellow_fall/status/2046959712672051238 · Twitter Post
• https://t.me/cveNotify/163325 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2460291 · Note
• https://access.redhat.com/security/cve/CVE-2026-40906 · Note