Postgrex
Monthly
SQL injection in the Elixir postgrex library allows local attackers with control over PostgreSQL LISTEN/UNLISTEN channel names to execute arbitrary SQL commands including DDL and DML operations. The Postgrex.Notifications module (versions 0.16.0 through 0.22.1) fails to escape double-quote characters in channel arguments, enabling attackers to break out of quoted identifiers and chain multi-statement payloads such as DROP TABLE commands. Vendor patch available in version 0.22.2 per GitHub advisory GHSA-r73h-97w8-m54h. No public exploit code or CISA KEV listing identified at time of analysis, though the technical details and patch diff are publicly disclosed.
SQL injection in Postgrex (elixir-ecto's PostgreSQL driver) versions 0.19.3 through 0.22.3 allows an attacker who controls the :comment option passed to Postgrex.stream/4 or Ecto.Repo.stream/2 to close the SQL comment delimiter with */ and inject arbitrary SQL clauses into the streamed statement, executing them under the existing database connection's role. The root cause is a missing call to the comment_not_present!/1 guard in stream/4, an oversight absent from every other execution path in the library. No public exploit code has been identified and no active exploitation appears in the CISA KEV catalog; the CVSS 4.0 vector (AV:L, AT:P) signals that exploitation requires specific, non-default application architecture.
SQL injection in the Elixir postgrex library allows local attackers with control over PostgreSQL LISTEN/UNLISTEN channel names to execute arbitrary SQL commands including DDL and DML operations. The Postgrex.Notifications module (versions 0.16.0 through 0.22.1) fails to escape double-quote characters in channel arguments, enabling attackers to break out of quoted identifiers and chain multi-statement payloads such as DROP TABLE commands. Vendor patch available in version 0.22.2 per GitHub advisory GHSA-r73h-97w8-m54h. No public exploit code or CISA KEV listing identified at time of analysis, though the technical details and patch diff are publicly disclosed.
SQL injection in Postgrex (elixir-ecto's PostgreSQL driver) versions 0.19.3 through 0.22.3 allows an attacker who controls the :comment option passed to Postgrex.stream/4 or Ecto.Repo.stream/2 to close the SQL comment delimiter with */ and inject arbitrary SQL clauses into the streamed statement, executing them under the existing database connection's role. The root cause is a missing call to the comment_not_present!/1 guard in stream/4, an oversight absent from every other execution path in the library. No public exploit code has been identified and no active exploitation appears in the CISA KEV catalog; the CVSS 4.0 vector (AV:L, AT:P) signals that exploitation requires specific, non-default application architecture.