Read the docs
TI-2026-25179 Aliases CVE-2026-32687GHSA-r73h-97w8-m54h

SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3

Priority LOW 34CWE-89Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' module) allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and 'Elixir.Postgrex.Notifications':unlisten/3 is interpolated directly into LISTEN "..." / UNLISTEN "..." SQL statements without escaping the " character. An attacker who can influence the channel name can inject a " to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect. This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines 'Elixir.Postgrex.Notifications':listen/3, 'Elixir.Postgrex.Notifications':unlisten/3, 'Elixir.Postgrex.Notifications':handle_connect/1. This issue affects postgrex: from 0.16.0 before 0.22.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00198 9th percentileScored 2026-11-07
Fix Fixed postgrex (elixir-ecto): 0.22.2postgrex (Hex): 0.22.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elixir-ectopostgrex0.16.0 to before 0.22.20.22.2Patch availableCNA
—postgrex (Hex)0.16.0 to before 0.22.20.22.2Patch availableGHSA-r73h-97w8-m54h
  • postgrex Vendorelixir-ecto Affected 0.16.0 to before 0.22.2 Fixed in 0.22.2 Patch available CNA
  • postgrex (Hex) Vendor— Affected 0.16.0 to before 0.22.2 Fixed in 0.22.2 Patch available GHSA-r73h-97w8-m54h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*0.16.0 to before 0.22.0Vulnerableelixir-ecto
  • cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:* Versions 0.16.0 to before 0.22.0 Vulnerable ·elixir-ecto

Remediation

  • Fix · CNA postgrex (elixir-ecto) Fixed in 0.22.2
  • Fix · GHSA-r73h-97w8-m54h postgrex (Hex) Fixed in 0.22.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32687
  2. 2026-10-03 Alias added: GHSA-r73h-97w8-m54h

References

Patch 1

Advisory 4

Other 1

  • TI-2026-47460 SQL injection via the :comment option in Postgrex.stream/4 CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences