Skip to content
OpenAdvisories

Vendor

electric-sql

1 known vulnerabilities.

Products

electric 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-40906

    Electric: SQL Injection via ORDER BY Parameter in Shape API

    Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlyin…

    electric-sql electric