What is the CVSS score of CVE-2026-40906?

CVE-2026-40906 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ElectricSQL are affected by CVE-2026-40906?

ElectricSQL's Electric Postgres sync engine (versions 1.1.12 through 1.4.x) contains an authenticated SQL injection vulnerability in the /v1/shape API that allows attackers with valid database…. A patch is available.

How to fix or mitigate CVE-2026-40906?

Within 24 hours, identify all deployments of ElectricSQL Electric between versions 1.1.12 and 1.4.x in your environment and prioritize systems exposing the /v1/shape API to multiple authenticated users; simultaneously validate Electric 1.5.0 patch deployment in a staging environment to confirm application compatibility. Within 7 days, deploy Electric 1.5.0 to all affected production systems, starting with those handling sensitive data or supporting high user counts. Within 30 days, complete patching of all remaining instances and verify via version enumeration and logs that no legacy versions remain accessible in production.

ElectricSQL CVE-2026-40906

EUVD-2026-24475 HIGH

SQL Injection (CWE-89)

2026-04-21 GitHub_M

SQLi PostgreSQL Electric

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable API with low complexity, but exploitation requires an authenticated shape-API user (PR:L); SQLi yields full read/write/destroy, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:03 vuln.today

Analysis Generated

Jul 24, 2026 - 07:03 vuln.today

Severity Changed

Jun 30, 2026 - 03:24 NVD

CRITICAL HIGH

CVSS changed

Jun 30, 2026 - 03:24 NVD

9.9 (CRITICAL) 8.8 (HIGH)

Patch released

Apr 22, 2026 - 21:24 nvd

Patch available

Apr 21, 2026 - 22:17 EUVD

CVSS changed

Apr 21, 2026 - 21:22 NVD

10.0 (CRITICAL) 9.9 (CRITICAL)

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24475

CVE Published

Apr 21, 2026 - 20:05 nvd

HIGH 8.8

CVE Published

Apr 21, 2026 - 20:05 nvd

CRITICAL 9.9

DescriptionNVD

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

AnalysisAI

Authenticated SQL injection in ElectricSQL's Electric Postgres sync engine (1.1.12 up to before 1.5.0) lets any authenticated user of the /v1/shape API smuggle arbitrary SQL through the order_by parameter. Because the shape layer forwarded the user-supplied ORDER BY string into a query with only permissive validation, crafted ORDER BY expressions (subqueries, casts, function calls) achieve error-based injection with full read, write, and destroy access to the backing PostgreSQL database. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the fix (1.5.0) and PR diff are public.

Technical ContextAI

Electric is a sync engine that streams subsets ('shapes') of a PostgreSQL database to clients over its HTTP /v1/shape API. The vulnerable path is in the Elixir sync-service order-by handling: Electric.Replication.Eval.Parser parsed 'SELECT 1 ORDER BY <user input>' with PgQuery and then relied on an AST walker whose catch-all clause (check_valid_refs(_, _, _) -> {:ok, :ok}) permitted any node type it did not explicitly reject, and it forwarded the raw user string downstream rather than a re-serialized safe form. This is a classic CWE-89 (SQL Injection) caused by an allowlist that behaved as a denylist: subqueries, type casts, and function calls in the ORDER BY were accepted. The affected package is cpe:2.3:a:electric-sql:electric, specifically the @core/sync-service component per the changeset. The 1.5.0 fix replaces the permissive catch-all with a deny-by-default allowlist of safe node types (SortBy, Node, String, A_Const, Array) and rebuilds the clause from the validated AST via PgQuery deparse (protobuf_to_query) instead of trusting the raw input.

RemediationAI

Vendor-released patch: upgrade to Electric 1.5.0, which fixes the ORDER BY validation (PR https://github.com/electric-sql/electric/pull/4081; advisory GHSA-h5rg-pxx7-r2hj) - this is the primary and recommended action. If an immediate upgrade is not possible, reduce exposure by restricting who can reach the /v1/shape API and revoking API access for untrusted or low-trust principals, since exploitation requires an authenticated user (trade-off: may disrupt legitimate low-trust clients relying on shape subsets). Where the order_by capability is not required, reject requests carrying an order_by parameter at a reverse proxy or API gateway (trade-off: breaks clients that legitimately sort). As defense-in-depth, run Electric's PostgreSQL connection under a least-privilege role so a successful injection cannot write or drop beyond that role's grants (trade-off: does not stop reads of accessible data and may require schema/permission changes). Do not treat workarounds as a substitute for the 1.5.0 upgrade.