CVE-2026-40906
Electric: SQL Injection via ORDER BY Parameter in Shape API
CVSS Score
10.0
EPSS Score
0.0%
EPSS Percentile
0th
Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.
| CWE | CWE-89 |
| Vendor | electric-sql |
| Product | electric |
| Published | Apr 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for electric-sql electric
Be the first to know when new critical vulnerabilities affecting electric-sql electric are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
electric-sql / electric
>= 1.1.12, < 1.5.0