Executive brief
A vulnerability in the Postgrex database driver for Elixir could allow an attacker to execute unauthorized database commands. This occurs when an application uses untrusted user input to name a database notification channel. An exploit could lead to the theft, modification, or deletion of sensitive data stored in the database.
Technical details
An SQL injection vulnerability exists in the 'Elixir.Postgrex.Notifications' module within the listen/3, unlisten/3, and handle_connect/1 functions. The 'channel' argument is interpolated directly into LISTEN and UNLISTEN SQL statements without escaping the double-quote (") character. Because these notifications use the PostgreSQL simple query protocol, an attacker can inject a double-quote to terminate the identifier and append multi-statement payloads (e.g., using semicolons). This allows for the execution of arbitrary DDL and DML commands with the privileges of the application's database role. The issue is fixed in version 0.22.2.
Affected products
- elixir-ecto postgrex >= 0.16.0, < 0.22.2
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-12: patched