The vulnerability in elixir-ecto postgrex (CVE-2026-32687) involves improper neutralization of special elements in SQL commands, leading to SQL Injection. The channel argument in Elixir.Postgrex.Notifications' listen/3, unlisten/3, and handle_connect/1 functions is interpolated directly into LISTEN and UNLISTEN SQL statements without escaping the double quote character. This enables an attacker controlling the channel name to break out of the quoted identifier and append arbitrary SQL commands. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing chaining of DDL and DML commands such as DROP TABLE. The issue affects postgrex versions starting from 0.16.0 before 0.22.2.

An attacker able to influence the channel name parameter can execute arbitrary SQL commands on the PostgreSQL database via the notifications connection. This can lead to unauthorized data manipulation or destruction, including dropping tables or modifying data. The vulnerability has a high severity with a CVSS 4.0 score of 7.5, reflecting the potential for significant impact on confidentiality, integrity, and availability of the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, avoid passing untrusted input to the channel argument of listen/3 and unlisten/3 functions. Implement input validation or sanitization on channel names to prevent injection of special characters, especially the double quote ("). Monitor vendor channels for updates and apply official fixes once released.