PT-2026-40034 · Hexpm · Postgrex

Peter Ullrich · Published 2026-05-12 · Updated 2026-05-18 · CVE-2026-32687

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions postgrex versions 0.16.0 through 0.22.1

Description An SQL Injection issue exists in the Elixir.Postgrex.Notifications module. The channel argument passed to the functions listen/3() and unlisten/3() is interpolated directly into SQL statements without escaping the double quote character. This allows an attacker who can influence the channel name to break out of the quoted identifier and append arbitrary SQL. Since the notifications connection utilizes the PostgreSQL simple query protocol, multi-statement payloads are accepted, enabling the chaining of Data Definition Language (DDL) and Data Manipulation Language (DML) commands. This unsanitized interpolation also occurs in the handle connect/1() function during the replay of commands after a reconnection.

Recommendations Update to version 0.22.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-32687

GHSA-R73H-97W8-M54H

Affected Products

Postgrex

References · 7

• https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h · Vendor Advisory
• https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770 · Patch
• https://osv.dev/vulnerability/GHSA-r73h-97w8-m54h · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-32687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32687 · Security Note
• https://github.com/elixir-ecto/ecto · Note
• https://cna.erlef.org/cves/CVE-2026-32687.html · Note