CVE-2026-66838

CVE-2026-66838: A SQL injection via the :comment option in Postgrex.stream/4 (affecting postgrex up to 0.22.4, and Elixir/Ecto exposure through Ecto.Repo.stream/2) arises because Postgrex concatenates the comment into the statement text in the Parse message without escaping or validating it. This...