CVE-2026-82734 Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value. Ash.Type.Decimal cast input through Ecto's decimal cast in castinput/2 and...

CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-66838

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

EUVD-2026-54476

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

CVE-2026-66838

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

CVE-2026-66838

Postgrex versions 0.19.3 to 0.22.3 are vulnerable: the :comment option passed to Postgrex.stream/4 is concatenated into the SQL Parse message without escaping, allowing attackers to close the comment delimiter with */ and inject clauses under the connection's role. CISA's SSVC marks exploitation ...

EEF-CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4

Summary Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the stream...

CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

MAL-2026-10893 Malicious code in ecto-cargo-wk1tm59a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee496f01ecebc77637213e597ba523c8cccda7efcd65e7ad2e700d804553dd29 Package [email protected] exhibits several contextual red flags worth human review: a randomized-suffix name pattern -wk1tm59a typical of...

Malicious code in ecto-cargo-wk1tm59a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee496f01ecebc77637213e597ba523c8cccda7efcd65e7ad2e700d804553dd29 Package [email protected] exhibits several contextual red flags worth human review: a randomized-suffix name pattern -wk1tm59a typical of...

MAL-2026-10061 Malicious code in cursed-ecto-d3ab00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49348969de68b56d680a46f67f817053621fa41a5220d8cd0bc1da720e77a5a1 The package has no legitimate functionality index.js is an empty module and exists solely to run an install-time attack payload. All four lifecycle...

Malicious code in ecto-spirit-win-k4n8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8082c12f69dfbb45e83017fa0baf4f88f9500649dd443e80f2d7d4f858020814 The package ships a postinstall.js that imports childprocess and references HTTP GET and hostname operations. Without traced-code corroboration of ho...

Malicious Package

Overview ecto-nightly-spirit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ecto-win-flag-q2m7 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in ecto-corsair-flag-x9m4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1e74d04f91a92c7c0205e252bc0002095d0c1ce9b9e9390083d267422e8b10 On npm install, postinstall.js executes attacker logic gated by hostname and working-directory checks designed to fire only inside CTF-style containe...

Malicious code in ecto-flag-read-m7p2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb2ef2851c6365e6198a67c4d395a1f3e7ca634559651063ce2e3b68a610cd3 The package's postinstall.js imports childprocess and references HTTP GET calls and hostname lookups during the install lifecycle. The co-occurrence ...

Malicious code in ecto-win-flag-q2m7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6344042aff547b32cf30bc456be25e1229f921217ec0d6777f470174df10792 On npm install, postinstall.js executes a harvest-and-exfiltrate chain against the installer's machine. It reads files under /app, /root, and...

MAL-2026-5691 Malicious code in ecto-spirit-win-k4n8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8082c12f69dfbb45e83017fa0baf4f88f9500649dd443e80f2d7d4f858020814 The package ships a postinstall.js that imports childprocess and references HTTP GET and hostname operations. Without traced-code corroboration of ho...

MAL-2026-5689 Malicious code in ecto-rust-read-f3a9c1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e73d10b993d9601d0dfe78d143a550ed008b8233beb8b88b7443208e4d0fa89d On install, postinstall.js evaluates a targeting heuristic isRealTarget that fires only when the build environment looks like a real corporate...