The vulnerability in elixir-ecto postgrex (CVE-2026-66838) is due to improper neutralization of special elements used in an SQL command, specifically via the :comment option of Postgrex.stream/4. The library appends the comment by concatenating it directly into the SQL statement without escaping or rejecting the sequence '*/'. An attacker able to influence this comment can close the comment delimiter and append additional SQL clauses that execute under the database connection's role. The Ecto.Repo.stream/2 interface exposes the same vulnerable option. The injection is confined to the streamed statement because the Parse message accepts only a single command, preventing statement chaining. This issue affects postgrex versions starting at 0.19.3 and before 0.22.4.

An attacker with the ability to control the :comment option in Postgrex.stream/4 or Ecto.Repo.stream/2 can inject SQL clauses into the streamed statement. These injected clauses execute with the privileges of the database connection role. However, the injection is limited to the streamed statement and cannot be used to execute multiple chained statements. This could lead to unauthorized data access or modification within the scope of the streamed query.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is indicated in the provided data. Until a patch is available, avoid passing untrusted input to the :comment option in Postgrex.stream/4 or Ecto.Repo.stream/2 to prevent injection. Monitor vendor communications for updates on remediation.