Vulnerability-Lookup

CVE-2026-32687 (GCVE-0-2026-32687)

Vulnerability from cvelistv5 – Published: 2026-05-12 14:18 – Updated: 2026-05-26 19:46

Title

SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' module) allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and 'Elixir.Postgrex.Notifications':unlisten/3 is interpolated directly into LISTEN "..." / UNLISTEN "..." SQL statements without escaping the " character. An attacker who can influence the channel name can inject a " to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect. This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines 'Elixir.Postgrex.Notifications':listen/3, 'Elixir.Postgrex.Notifications':unlisten/3, 'Elixir.Postgrex.Notifications':handle_connect/1. This issue affects postgrex: from 0.16.0 before 0.22.2, from pkg:github/elixir-ecto/postgrex@266b530faf9bde094e31e0e4ab851f933fadc0f5 before 0.22.2.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

EEF

References

4 references

URL	Tags
https://github.com/elixir-ecto/ecto/security/advi…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-32687.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-32687	related
https://github.com/elixir-ecto/postgrex/commit/7c…	patch

Impacted products

2 products

Vendor	Product	Version
elixir-ecto	postgrex	Affected: 0.16.0 , < 0.22.2 (semver) cpe:2.3:a:elixir-ecto:postgrex::::::::
elixir-ecto	postgrex	Affected: 266b530faf9bde094e31e0e4ab851f933fadc0f5 , < 7cdedbd4316bb65f82e6a9a4f922c0ac491cb770 (git) cpe:2.3:a:elixir-ecto:postgrex::::::::

Credits

Peter Ullrich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32687",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T19:44:22.093287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T19:44:35.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex.Notifications\u0027"
          ],
          "packageName": "postgrex",
          "packageURL": "pkg:hex/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex/notifications.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:listen/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex.git",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "0.22.2",
              "status": "affected",
              "version": "0.16.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex.Notifications\u0027"
          ],
          "packageName": "elixir-ecto/postgrex",
          "packageURL": "pkg:github/elixir-ecto/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex/notifications.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:listen/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex.git",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "7cdedbd4316bb65f82e6a9a4f922c0ac491cb770",
              "status": "affected",
              "version": "266b530faf9bde094e31e0e4ab851f933fadc0f5",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must call \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e or \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e with a channel name derived from untrusted user input.\u003c/p\u003e"
            }
          ],
          "value": "The application must call \u0027Elixir.Postgrex.Notifications\u0027:listen/3 or \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 with a channel name derived from untrusted user input."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.22.2",
                  "versionStartIncluding": "0.16.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027\u003c/tt\u003e module) allows SQL Injection.\u003cp\u003eThe \u003ctt\u003echannel\u003c/tt\u003e argument passed to \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e and \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e is interpolated directly into \u003ctt\u003eLISTEN \"...\"\u003c/tt\u003e / \u003ctt\u003eUNLISTEN \"...\"\u003c/tt\u003e SQL statements without escaping the \u003ctt\u003e\"\u003c/tt\u003e character. An attacker who can influence the channel name can inject a \u003ctt\u003e\"\u003c/tt\u003e to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. \u003ctt\u003e; DROP TABLE ...; --\u003c/tt\u003e). The same unsanitized interpolation also occurs in \u003ctt\u003ehandle_connect/1\u003c/tt\u003e when replaying LISTEN commands after a reconnect.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/postgrex/notifications.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects postgrex: from 0.16.0 before 0.22.2, from pkg:github/elixir-ecto/postgrex@266b530faf9bde094e31e0e4ab851f933fadc0f5 before 0.22.2.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u0027Elixir.Postgrex.Notifications\u0027 module) allows SQL Injection.\n\nThe channel argument passed to \u0027Elixir.Postgrex.Notifications\u0027:listen/3 and \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 is interpolated directly into LISTEN \"...\" / UNLISTEN \"...\" SQL statements without escaping the \" character. An attacker who can influence the channel name can inject a \" to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect.\n\nThis vulnerability is associated with program file lib/postgrex/notifications.ex and program routines \u0027Elixir.Postgrex.Notifications\u0027:listen/3, \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3, \u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1.\n\nThis issue affects postgrex: from 0.16.0 before 0.22.2, from pkg:github/elixir-ecto/postgrex@266b530faf9bde094e31e0e4ab851f933fadc0f5 before 0.22.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T19:46:52.054Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-32687.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32687"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-32687",
    "datePublished": "2026-05-12T14:18:07.607Z",
    "dateReserved": "2026-03-13T09:12:14.475Z",
    "dateUpdated": "2026-05-26T19:46:52.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32687",
      "date": "2026-05-27",
      "epss": "9e-05",
      "percentile": "0.00866"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-32687\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-05-12T15:16:12.810\",\"lastModified\":\"2026-05-21T18:54:59.587\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u0027Elixir.Postgrex.Notifications\u0027 module) allows SQL Injection.\\n\\nThe channel argument passed to \u0027Elixir.Postgrex.Notifications\u0027:listen/3 and \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 is interpolated directly into LISTEN \\\"...\\\" / UNLISTEN \\\"...\\\" SQL statements without escaping the \\\" character. An attacker who can influence the channel name can inject a \\\" to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect.\\n\\nThis vulnerability is associated with program file lib/postgrex/notifications.ex and program routines \u0027Elixir.Postgrex.Notifications\u0027:listen/3, \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3, \u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1.\\n\\nThis issue affects postgrex: from 0.16.0 before 0.22.2, from pkg:github/elixir-ecto/postgrex@266b530faf9bde094e31e0e4ab851f933fadc0f5 before 0.22.2.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.16.0\",\"versionEndExcluding\":\"0.22.0\",\"matchCriteriaId\":\"40050434-50AF-4ADC-AEE9-9374ECB91F30\"}]}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-32687.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Patch\"]},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-32687\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32687\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-12T19:44:22.093287Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-12T19:44:30.638Z\"}}], \"cna\": {\"title\": \"SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}], \"impacts\": [{\"capecId\": \"CAPEC-66\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-66 SQL Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-ecto/postgrex.git\", \"vendor\": \"elixir-ecto\", \"modules\": [\"\u0027Elixir.Postgrex.Notifications\u0027\"], \"product\": \"postgrex\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.16.0\", \"lessThan\": \"0.22.2\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/postgrex\", \"packageName\": \"postgrex\", \"programFiles\": [\"lib/postgrex/notifications.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Postgrex.Notifications\u0027:listen/3\"}, {\"name\": \"\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\"}, {\"name\": \"\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1\"}]}, {\"cpes\": [\"cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-ecto/postgrex.git\", \"vendor\": \"elixir-ecto\", \"modules\": [\"\u0027Elixir.Postgrex.Notifications\u0027\"], \"product\": \"postgrex\", \"versions\": [{\"status\": \"affected\", \"version\": \"266b530faf9bde094e31e0e4ab851f933fadc0f5\", \"lessThan\": \"7cdedbd4316bb65f82e6a9a4f922c0ac491cb770\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/elixir-ecto/postgrex\", \"packageName\": \"elixir-ecto/postgrex\", \"programFiles\": [\"lib/postgrex/notifications.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Postgrex.Notifications\u0027:listen/3\"}, {\"name\": \"\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\"}, {\"name\": \"\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1\"}]}], \"references\": [{\"url\": \"https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-32687.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-32687\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u0027Elixir.Postgrex.Notifications\u0027 module) allows SQL Injection.\\n\\nThe channel argument passed to \u0027Elixir.Postgrex.Notifications\u0027:listen/3 and \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 is interpolated directly into LISTEN \\\"...\\\" / UNLISTEN \\\"...\\\" SQL statements without escaping the \\\" character. An attacker who can influence the channel name can inject a \\\" to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect.\\n\\nThis vulnerability is associated with program file lib/postgrex/notifications.ex and program routines \u0027Elixir.Postgrex.Notifications\u0027:listen/3, \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3, \u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1.\\n\\nThis issue affects postgrex: from 0.16.0 before 0.22.2, from pkg:github/elixir-ecto/postgrex@266b530faf9bde094e31e0e4ab851f933fadc0f5 before 0.22.2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027\u003c/tt\u003e module) allows SQL Injection.\u003cp\u003eThe \u003ctt\u003echannel\u003c/tt\u003e argument passed to \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e and \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e is interpolated directly into \u003ctt\u003eLISTEN \\\"...\\\"\u003c/tt\u003e / \u003ctt\u003eUNLISTEN \\\"...\\\"\u003c/tt\u003e SQL statements without escaping the \u003ctt\u003e\\\"\u003c/tt\u003e character. An attacker who can influence the channel name can inject a \u003ctt\u003e\\\"\u003c/tt\u003e to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. \u003ctt\u003e; DROP TABLE ...; --\u003c/tt\u003e). The same unsanitized interpolation also occurs in \u003ctt\u003ehandle_connect/1\u003c/tt\u003e when replaying LISTEN commands after a reconnect.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/postgrex/notifications.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects postgrex: from 0.16.0 before 0.22.2, from pkg:github/elixir-ecto/postgrex@266b530faf9bde094e31e0e4ab851f933fadc0f5 before 0.22.2.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The application must call \u0027Elixir.Postgrex.Notifications\u0027:listen/3 or \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 with a channel name derived from untrusted user input.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe application must call \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e or \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e with a channel name derived from untrusted user input.\u003c/p\u003e\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.22.2\", \"versionStartIncluding\": \"0.16.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-05-26T19:46:52.054Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-32687\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-26T19:46:52.054Z\", \"dateReserved\": \"2026-03-13T09:12:14.475Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-05-12T14:18:07.607Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-32687

Vulnerability from fkie_nvd - Published: 2026-05-12 15:16 - Updated: 2026-05-21 18:54

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-32687.html	Third Party Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h	Vendor Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770	Patch
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-32687	Third Party Advisory

Impacted products

	Vendor	Product	Version
	elixir-ecto	postgrex	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "40050434-50AF-4ADC-AEE9-9374ECB91F30",
              "versionEndExcluding": "0.22.0",
              "versionStartIncluding": "0.16.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u0027Elixir.Postgrex.Notifications\u0027 module) allows SQL Injection.\n\nThe channel argument passed to \u0027Elixir.Postgrex.Notifications\u0027:listen/3 and \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 is interpolated directly into LISTEN \"...\" / UNLISTEN \"...\" SQL statements without escaping the \" character. An attacker who can influence the channel name can inject a \" to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect.\n\nThis vulnerability is associated with program file lib/postgrex/notifications.ex and program routines \u0027Elixir.Postgrex.Notifications\u0027:listen/3, \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3, \u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1.\n\nThis issue affects postgrex: from 0.16.0 before 0.22.2, from pkg:github/elixir-ecto/postgrex@266b530faf9bde094e31e0e4ab851f933fadc0f5 before 0.22.2."
    }
  ],
  "id": "CVE-2026-32687",
  "lastModified": "2026-05-21T18:54:59.587",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-12T15:16:12.810",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cna.erlef.org/cves/CVE-2026-32687.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32687"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-R73H-97W8-M54H

Vulnerability from github – Published: 2026-05-18 17:53 – Updated: 2026-05-18 17:53

Summary

Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3`

Details

Summary

SQL injection in Postgrex.Notifications.listen/3: the channel argument is interpolated straight into LISTEN "..." / UNLISTEN "..." without escaping the " character. Any caller that lets a user influence the channel name (e.g. a pub/sub bridge that uses a tenant id or topic slug as the channel) and the name is not sanitized can execute arbitrary SQL on the notifications connection.

Only those using the Postgrex.Notifications directly or via a dependency, with a non-sanitized channel name are vulnerable. Ecto does not use Postgrex.Notifications by default, but you must validate if any other dependency does.

Details

PostgreSQL escapes a " inside a quoted identifier by doubling it to "". Postgrex doesn't do that doubling, so a " inside channel closes the identifier early and everything after it is parsed as SQL on the same connection.

The notifications connection runs as whatever DB role the app is configured with. Unlike the Postgrex.query/4 API, there's no extended-protocol guard here: LISTEN/UNLISTEN are sent as simple queries, so multi-statement payloads work and the attacker can chain ; CREATE TABLE …, ; DROP …, ; CREATE ROLE …, etc.

Impact

SQL injection on the notifications connection. Affects any application that calls Postgrex.Notifications.listen/3 (or unlisten/3) with a channel name derived from untrusted input. Executes as the configured DB user with no protocol-level limit on what can be chained, so the realistic blast radius is read/modify/destroy on any data the app's DB role can reach.

Fix

Upgrade to latest Postgrex v0.22.2 or later. Altenratively, sanitize any user input given as channel name by making sure it doesn't include quotes as well as null bytes (not strictly required, but recommended):

if String.contains?(channel_name, ["\"", "\0"]) do
  raise "bad channel name"
end

Severity

7.5 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "postgrex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.22.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32687"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T17:53:17Z",
    "nvd_published_at": "2026-05-12T15:16:12Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nSQL injection in `Postgrex.Notifications.listen/3`: the `channel` argument is interpolated straight into `LISTEN \"...\"` / `UNLISTEN \"...\"` without escaping the `\"` character. Any caller that lets a user influence the channel name (e.g. a pub/sub bridge that uses a tenant id or topic slug as the channel) and the name is not sanitized can execute arbitrary SQL on the notifications connection.\n\nOnly those using the `Postgrex.Notifications` directly or via a dependency, with a non-sanitized channel name are vulnerable. Ecto does not use Postgrex.Notifications by default, but you must validate if any other dependency does.\n\n### Details\n\nPostgreSQL escapes a `\"` inside a quoted identifier by doubling it to `\"\"`. Postgrex doesn\u0027t do that doubling, so a `\"` inside `channel` closes the identifier early and everything after it is parsed as SQL on the same connection.\n\nThe notifications connection runs as whatever DB role the app is configured with. Unlike the `Postgrex.query/4` API, there\u0027s no extended-protocol guard here: `LISTEN`/`UNLISTEN` are sent as simple queries, so multi-statement payloads work and the attacker can chain `; CREATE TABLE \u2026`, `; DROP \u2026`, `; CREATE ROLE \u2026`, etc.\n\n### Impact\n\nSQL injection on the notifications connection. Affects any application that calls `Postgrex.Notifications.listen/3` (or `unlisten/3`) with a channel name derived from untrusted input. Executes as the configured DB user with no protocol-level limit on what can be chained, so the realistic blast radius is read/modify/destroy on any data the app\u0027s DB role can reach.\n\n### Fix\n\nUpgrade to latest Postgrex v0.22.2 or later. Altenratively, sanitize any user input given as channel name by making sure it doesn\u0027t include quotes as well as null bytes (not strictly required, but recommended):\n\n```elixir\nif String.contains?(channel_name, [\"\\\"\", \"\\0\"]) do\n  raise \"bad channel name\"\nend\n```",
  "id": "GHSA-r73h-97w8-m54h",
  "modified": "2026-05-18T17:53:17Z",
  "published": "2026-05-18T17:53:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32687"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-32687.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elixir-ecto/ecto"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32687"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3`"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-32687 (GCVE-0-2026-32687)

FKIE_CVE-2026-32687

GHSA-R73H-97W8-M54H

Summary

Details

Impact

Fix

Tags

Sightings

Nomenclature