The vulnerability arises because Postgrex.stream/4 concatenates the :comment option directly into the SQL statement without escaping or rejecting the comment terminator sequence '*/'. This allows an attacker who can influence the :comment value to prematurely close the comment and append additional SQL clauses that execute with the connection's privileges. The validation function comment_not_present!/1 is not called by stream/4, unlike other execution points. The injection is confined to the streamed statement since the Parse message accepts only a single command. The issue affects postgrex versions >=0.19.3 and <0.22.4.

An attacker able to control the :comment option in Postgrex.stream/4 or Ecto.Repo.stream/2 can perform SQL Injection within the streamed statement. This could lead to unauthorized data access or manipulation under the database connection's role. However, the injection is limited to a single statement and cannot chain multiple SQL commands. The vulnerability requires local access or ability to influence the :comment parameter, limiting remote exploitation potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input to the :comment option in Postgrex.stream/4 and Ecto.Repo.stream/2. Review application code to ensure that the :comment parameter is not influenced by external or untrusted sources.