CRITICAL SQLi in ElectricSQL: Full Database Compromise

The National Vulnerability Database has disclosed CVE-2026-40906, a critical SQL injection vulnerability in ElectricSQL, a PostgreSQL sync engine. Affecting versions 1.1.12 up to, but not including, 1.5.0, this flaw resides in the /v1/shape API’s order_by parameter.

This isn’t a theoretical risk; it’s a full-blown database compromise. According to the National Vulnerability Database, any authenticated user can exploit this error-based SQL injection to read, write, and even destroy the entire contents of the underlying PostgreSQL database through crafted ORDER BY expressions. The CVSS score of 9.9 (CRITICAL) accurately reflects the severity of this direct path to data exfiltration and integrity violation.

ElectricSQL versions 1.5.0 and later contain the fix. Organizations leveraging ElectricSQL as a Postgres sync engine must prioritize immediate patching. This type of vulnerability is a gift to attackers, turning a standard authenticated user into a database administrator with minimal effort. It’s a stark reminder that even internal APIs, when exposed to authenticated users, demand the same rigorous security scrutiny as public-facing endpoints.