CVE-2026-66838

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4.

• CWE-89

• https://cna.erlef.org/cves/CVE-2026-66838.htmlPatch, Third Party Advisory
• https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388Exploit, Patch, Vendor Advisory
• https://github.com/elixir-ecto/postgrex/commit/4011be852c99dc61ddb98cb01aa41e8775a0e3ddPatch
• https://github.com/elixir-ecto/postgrex/commit/e1ecba618ddea4cee2556bd6ad9b6285e05f9d3cPatch
• https://osv.dev/vulnerability/EEF-CVE-2026-66838Patch, Third Party Advisory
• https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388Exploit, Patch, Vendor Advisory

Published

Aug 7, 2026

Last Modified

Aug 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66824A stored cross-site scripting vulnerability existed in the c…9.2
• CVE-2026-66825Pivotick contains a cross-site scripting vulnerability in th…6.9
• CVE-2026-66829URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2026-6683FatFs R0.16 and earlier contains a divide-by-zero in exFAT s…4.6
• CVE-2026-66832When the Mira Android app opens in-app WebView content (e.g.…6.5
• CVE-2026-66835Path Equivalence vulnerability in Erlang/OTP inets httpd all…8.2
• CVE-2026-66839NetKids iMark, provided by Integrated Systems Technologies, …8.4
• CVE-2026-6684FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = …4.6
• CVE-2026-66840XING CPTrans-ME-X contains an Exposure of Sensitive System I…8.7
• CVE-2026-66842BIG-IP has a vulnerability where an authenticated user of an…8.8
• CVE-2026-66843Inclusion of Functionality from Untrusted Control Sphere vul…6.1
• CVE-2026-6685Rejected reason: This CVE ID has been rejected or withdrawn …