Postgrex CVE-2026-66838

Postgrex is the primary PostgreSQL driver for the Elixir ecosystem, used directly and as the backing adapter for Ecto (the widely-used Elixir data mapping and query layer). The :comment option exists to embed tracing or diagnostic metadata into the SQL comment prepended to each statement. Postgrex implements this by string-concatenating the caller-supplied comment into the statement text sent in the PostgreSQL wire-protocol Parse message. Every other execution entry point (query, execute, prepare, etc.) calls the internal comment_not_present!/1 validator, which raises an error if the comment string contains the */ delimiter-closing sequence or null bytes. The stream/4 function - and by extension Ecto.Repo.stream/2 - never invoked this guard, leaving the code path unprotected. CWE-89 (Improper Neutralization of Special Elements in SQL Commands) applies directly: user-supplied data reaches the SQL layer without sanitization. Critically, PostgreSQL's Parse message accepts exactly one command, so the injected clauses are constrained to modifying the single streamed statement (e.g., appending UNION, WHERE, or RETURNING clauses) - multi-statement chaining is architecturally prevented. Affected CPE: cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:* from 0.19.3 to 0.22.3.