Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.9 | High | 4.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | CNA (EEF) |
- CISA KEV Not listed.
- EPSS 0.0049, the 42nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 4 Nov 2026, 13:57 UTC Confirmed by the CVE List
- 4 Nov 2026, 14:00 UTC Confirmed by OSV
- 4 Nov 2026, 14:09 UTC First seen by agentprime
- 4 Nov 2026, 14:17 UTC Confirmed by NVD
Sources
- GitHub Advisory Database: GHSA-cxjx-vmm2-qr8r
- OSV: GHSA-cxjx-vmm2-qr8r
- github.com/elixir-ecto/ecto/security/advisories/GHSA-cxjx-vmm2-qr8r
- cna.erlef.org/cves/CVE-2026-118391.html
- github.com/elixir-ecto/ecto/commit/d0e97d8a6e274c81c25fbf08087da8d8b9bae0ea
- ecto.hexdocs.pm/Ecto.Query.API.html#json_extract_path/2
- ecto.hexdocs.pm/Ecto.Query.API.html#splice/1
- github.com/elixir-ecto/ecto/commit/eb03f45b999e2bf67ffae92811233eb6e56dba55
- github.com/elixir-ecto/ecto/issues/4470
- github.com/elixir-ecto/ecto/issues/1031
- github.com/elixir-ecto/ecto/commit/cb2f03964dac324a9771f84f5088e395326e6de8
- github.com/elixir-ecto/ecto/commit/eef014ad090d27d1a5b69c0e32a50eabd44ab3bb
- hex.pm/packages/ecto