AIKIDO-2026-335501

TL;DR

Postgrex.Notifications escapes double quotes in LISTEN channel names via quote_channel/1, but does not escape PostgreSQL's $$ dollar-quote delimiter. On every reconnect, handle_connect/1 replays all registered channels inside a DO $$BEGIN ... END$$ block. A channel name containing $$ (for example x$$;SELECT 1;--) prematurely closes the dollar-quoted block, PostgreSQL rejects the malformed query on each reconnect, and notifications silently stop for every channel sharing that connection. Double-quote escaping prevents arbitrary SQL execution, so the impact is denial of service rather than data breach. Version 0.22.3 escapes $$ in channel names before embedding them in the reconnect replay query.