CVE-2026-40906

CVE-2026-40906 is a critical SQL injection vulnerability in ElectricSQL versions 1.1.12 through 1.4.x affecting the /v1/shape API's order_by parameter. The flaw allows authenticated users to inject malicious ORDER BY expressions and gain unauthorized access to the underlying PostgreSQL database. The vulnerability was remediated in version 1.5.0. The vulnerability carries a CVSS 3.1 score of 9.9 (Critical) with a network-based attack vector, low complexity, and low privilege requirements. Successful exploitation enables complete compromise of database confidentiality, integrity, and availability, as attackers can read, write, and destroy all PostgreSQL database contents. The broad scope impact indicates potential for lateral movement or system-wide compromise beyond the application layer. There is currently no evidence of active exploitation in the wild, and the vulnerability does not appear on the KEV catalog or CISA Hot List. However, organizations running vulnerable versions should prioritize upgrading to 1.5.0 immediately given the critical severity rating and the low barrier to exploitation for authenticated users.