VIR Vulnerability Intelligence Relay

CVE-2026-40906

high
Published 2026-04-21 · Modified 2026-05-13
CVSS v3
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2
—
VIR risk
8.8

Description

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj

Application impact
VendorProductVersionsFixed
electricsync-service{"startIncluding":"1.1.12","endExcluding":"1.5.0"}1.5.0

References

CWEs

CWE-89

Verify integrity in audit chain (admin only). AS-IS.