AIKIDO-2026-848264

TL;DR

Postgrex.stream/4 appends the caller-supplied :comment option into the SQL text of the PostgreSQL Parse message by concatenation, without escaping or rejecting */. An attacker who can influence that value can close the comment delimiter and extend the streamed statement with their own clauses, which then execute under the connection's database role. Ecto.Repo.stream/2 exposes the same option. Other query paths already reject unsafe comments via comment_not_present!/1, but stream/4 never calls it. The fix rejects comment values that contain */ or a null byte before they are sent.