https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 20:35:19 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32687 <p><strong>Affected:</strong> elixir-ecto postgrex</p> <p>Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in elixir-ecto postgrex (&#39;Elixir.Postgrex.Notifications&#39; module) allows SQL Injection.</p> <p>The channel argument passed to &#39;Elixir.Postgrex.Notifications&#39;:listen/3 and &#39;Elixir.Postgrex.Notifications&#39;:unlisten/3 is interpolated directly into LISTEN &#34;...&#34; / UNLISTEN &#34;...&#34; SQL statements without escaping the &#34; character. An attacker who can influence the channel name can inject a &#34; to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect.</p> <p>This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines &#39;Elixir.Postgrex.Notifications&#39;:listen/3, &#39;Elixir.Postgrex.Notifications&#39;:unlisten/3, &#39;Elixir.Postgrex.Notifications&#39;:handle_connect/1.</p> <p>This issue affects postgrex: from 0.16.0 before 0.22.2.</p> <p><strong>Affected:</strong> elixir-ecto postgrex</p> <p>Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in elixir-ecto postgrex (&#39;Elixir.Postgrex.Notifications&#39; module) allows SQL Injection.</p> <p>The channel argument passed to &#39;Elixir.Postgrex.Notifications&#39;:listen/3 and &#39;Elixir.Postgrex.Notifications&#39;:unlisten/3 is interpolated directly into LISTEN &#34;...&#34; / UNLISTEN &#34;...&#34; SQL statements without escaping the &#34; character. An attacker who can influence the channel name can inject a &#34; to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect.</p> <p>This vulnerability is associated with program file lib/postgrex/notifications.ex and program routines &#39;Elixir.Postgrex.Notifications&#39;:listen/3, &#39;Elixir.Postgrex.Notifications&#39;:unlisten/3, &#39;Elixir.Postgrex.Notifications&#39;:handle_connect/1.</p> <p>This issue affects postgrex: from 0.16.0 before 0.22.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-32687