CVE-2026-66838 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-66838MEDIUM

elixir-ecto postgrex — SQL injection via the :comment option in Postgrex.stream/4

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   P   N   N   H   L   N    5.9   .0024   15.4     —

AFFECTED
  Product   Versions                                    Fixed
  postgrex  0.19.3 –                                    —
  postgrex  4971a2722fa72f8e1b54a2c403cad4c43916e36d –  e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c

TIMELINE
  Aug 6   Reserved by EEF
  Aug 7   EXPLOIT PUBLISHED — CVE-2026-66838 (elixir-ecto postgrex). Public exploit reference added.
  Aug 7   Published (CNA: EEF)

CWE-89 · CNA: EEF · CVSS v4.0 · 5 references · NVD status: Analyzed

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 6, 2026	Reserved	Reserved by EEF
August 7, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-66838 (elixir-ecto postgrex). Public exploit reference added.
August 7, 2026	Published	Published (CNA: EEF)

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
elixir-ecto	postgrex	—	0.19.3	—
elixir-ecto	postgrex	—	4971a2722fa72f8e1b54a2c403cad4c43916e36d	e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c

Weaknesses

CWE-89

References (5)

https://cna.erlef.org/cves/CVE-2026-66838.html [Patch, Third Party Advisory]
https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388 [Exploit, Patch, Vendor Advisory]
https://github.com/elixir-ecto/postgrex/commit/4011be852c99dc61ddb98cb01aa41e8775a0e3dd [Patch]
https://github.com/elixir-ecto/postgrex/commit/e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c [Patch]
https://osv.dev/vulnerability/EEF-CVE-2026-66838 [Patch, Third Party Advisory]

Authoritative record: CVE-2026-66838 at cve.org

Vendors: elixir-ecto

Weaknesses: CWE-89

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-66838 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.