{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-66838",
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "state": "PUBLISHED",
        "assignerShortName": "EEF",
        "dateReserved": "2026-08-06T14:00:01.865Z",
        "datePublished": "2026-08-07T12:20:02.376Z",
        "dateUpdated": "2026-08-07T15:12:12.308Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.Postgrex'",
                        "'Elixir.Postgrex.Protocol'"
                    ],
                    "packageName": "postgrex",
                    "packageURL": "pkg:hex/postgrex",
                    "product": "postgrex",
                    "programFiles": [
                        "lib/postgrex.ex",
                        "lib/postgrex/protocol.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.Postgrex':stream/4"
                        },
                        {
                            "name": "'Elixir.Postgrex.Protocol':parse_describe_comment_msgs/3"
                        }
                    ],
                    "repo": "https://github.com/elixir-ecto/postgrex",
                    "vendor": "elixir-ecto",
                    "versions": [
                        {
                            "lessThan": "0.22.4",
                            "status": "affected",
                            "version": "0.19.3",
                            "versionType": "semver"
                        }
                    ]
                },
                {
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.Postgrex'",
                        "'Elixir.Postgrex.Protocol'"
                    ],
                    "packageName": "elixir-ecto/postgrex",
                    "packageURL": "pkg:github/elixir-ecto/postgrex",
                    "product": "postgrex",
                    "programFiles": [
                        "lib/postgrex.ex",
                        "lib/postgrex/protocol.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.Postgrex':stream/4"
                        },
                        {
                            "name": "'Elixir.Postgrex.Protocol':parse_describe_comment_msgs/3"
                        }
                    ],
                    "repo": "https://github.com/elixir-ecto/postgrex",
                    "vendor": "elixir-ecto",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "4011be852c99dc61ddb98cb01aa41e8775a0e3dd",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "4971a2722fa72f8e1b54a2c403cad4c43916e36d",
                            "versionType": "git"
                        }
                    ]
                }
            ],
            "configurations": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>The application must pass a <code>:comment</code> derived from untrusted input to <code>Postgrex.stream/4</code> or <code>Ecto.Repo.stream/2</code>. Applications that omit the option or pass only static values are unaffected.</p>"
                        },
                        {
                            "base64": false,
                            "type": "text/markdown",
                            "value": "The application must pass a `:comment` derived from untrusted input to `Postgrex.stream/4` or `Ecto.Repo.stream/2`. Applications that omit the option or pass only static values are unaffected."
                        }
                    ],
                    "value": "The application must pass a :comment derived from untrusted input to Postgrex.stream/4 or Ecto.Repo.stream/2. Applications that omit the option or pass only static values are unaffected."
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "cpeMatch": [
                                {
                                    "criteria": "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*",
                                    "versionEndExcluding": "0.22.4",
                                    "versionStartIncluding": "0.19.3",
                                    "vulnerable": true
                                }
                            ],
                            "negate": false,
                            "operator": "OR"
                        }
                    ],
                    "operator": "AND"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Snehil Shah"
                },
                {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "José Valim"
                },
                {
                    "lang": "en",
                    "type": "analyst",
                    "value": "Jonatan Männchen / EEF"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the <code>:comment</code> option of <code>Postgrex.stream/4</code>. An attacker who can influence that value can close the comment delimiter with <code>*/</code> and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through <code>Ecto.Repo.stream/2</code>.</p>\n<p>Postgrex appends the comment by concatenating it into the statement text sent in the <code>Parse</code> message, without escaping or rejecting <code>*/</code>. The option is validated by <code>comment_not_present!/1</code> at every other execution point; <code>stream/4</code> never calls it. Because <code>Parse</code> accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.</p>\n<p>This issue affects postgrex: from 0.19.3 before 0.22.4.</p>"
                        },
                        {
                            "base64": false,
                            "type": "text/markdown",
                            "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the `:comment` option of `Postgrex.stream/4`. An attacker who can influence that value can close the comment delimiter with `*/` and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through `Ecto.Repo.stream/2`.\n\nPostgrex appends the comment by concatenating it into the statement text sent in the `Parse` message, without escaping or rejecting `*/`. The option is validated by `comment_not_present!/1` at every other execution point; `stream/4` never calls it. Because `Parse` accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.\n\nThis issue affects postgrex: from 0.19.3 before 0.22.4."
                        }
                    ],
                    "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2.\n\nPostgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.\n\nThis issue affects postgrex: from 0.19.3 before 0.22.4."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-66",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-66 SQL Injection"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "PRESENT",
                        "attackVector": "LOCAL",
                        "baseScore": 5.9,
                        "baseSeverity": "MEDIUM",
                        "privilegesRequired": "NONE",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "NONE",
                        "subConfidentialityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "NONE",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "LOW",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-89",
                            "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
                "shortName": "EEF",
                "dateUpdated": "2026-08-07T12:20:02.376Z"
            },
            "references": [
                {
                    "tags": [
                        "vendor-advisory",
                        "related"
                    ],
                    "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388"
                },
                {
                    "tags": [
                        "related"
                    ],
                    "url": "https://cna.erlef.org/cves/CVE-2026-66838.html"
                },
                {
                    "tags": [
                        "related"
                    ],
                    "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66838"
                },
                {
                    "tags": [
                        "patch"
                    ],
                    "url": "https://github.com/elixir-ecto/postgrex/commit/e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c"
                },
                {
                    "tags": [
                        "patch"
                    ],
                    "url": "https://github.com/elixir-ecto/postgrex/commit/4011be852c99dc61ddb98cb01aa41e8775a0e3dd"
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            },
            "title": "SQL injection via the :comment option in Postgrex.stream/4",
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>Reject any <code>:comment</code> value containing <code>*/</code> or a null byte before passing it to <code>Postgrex.stream/4</code> or <code>Ecto.Repo.stream/2</code>. Alternatively, build comments only from trusted values.</p>"
                        },
                        {
                            "base64": false,
                            "type": "text/markdown",
                            "value": "Reject any `:comment` value containing `*/` or a null byte before passing it to `Postgrex.stream/4` or `Ecto.Repo.stream/2`. Alternatively, build comments only from trusted values."
                        }
                    ],
                    "value": "Reject any :comment value containing */ or a null byte before passing it to Postgrex.stream/4 or Ecto.Repo.stream/2. Alternatively, build comments only from trusted values."
                }
            ]
        },
        "adp": [
            {
                "references": [
                    {
                        "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388",
                        "tags": [
                            "exploit"
                        ]
                    }
                ],
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-08-07T15:11:28.060095Z",
                                "id": "CVE-2026-66838",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-08-07T15:12:12.308Z"
                }
            }
        ]
    }
}