High 7.5Published May 12, 2026

CVE-2026-32687SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3

Updated under an hour ago (Oct 26, 2026, 9:00 PM ET)

Does this affect you?

It affects elixir-ecto postgrex. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for elixir-ecto postgrex

Exploited in the last 30 days

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' module) allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and 'Elixir.Postgrex.Notifications':unlisten/3 is interpolated directly into LISTEN "..." / UNLISTEN "..." SQL statements without escaping the " character. An attacker who can influence the channel name can inject a " to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect. This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines 'Elixir.Postgrex.Notifications':listen/3, 'Elixir.Postgrex.Notifications':unlisten/3, 'Elixir.Postgrex.Notifications':handle_connect/1. This issue affects postgrex: from 0.16.0 before 0.22.2.

CVSS: 7.5 HIGH (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-89
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: EEF
NVD analysis: Modified
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

elixir-ecto postgrex elixir-ecto:postgrex	from 0.16.0 before 0.22.2	CNA record
elixir-ecto postgrex elixir-ecto:postgrex	from 0.16.0 before 0.22.0	NVD

References

References

https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h	vendor-advisory, related
https://cna.erlef.org/cves/CVE-2026-32687.html	related, third-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-32687	related, third-party-advisory
https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.