{"id":"GHSA-j88v-2chj-qfwx","revision":"dad8092a27d347248a961ff47bb075c7","records":[{"revision":"dad8092a27d347248a961ff47bb075c7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-j88v-2chj-qfwx","aliases":["CVE-2026-41889","GO-2026-5004"],"title":"pgx: SQL Injection via placeholder confusion with dollar quoted string literals","description":"### Impact\n\nSQL Injection can occur when:\n\n1. The non-default simple protocol is used.\n2. A dollar quoted string literal is used in the SQL query.\n3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.\n4. The value of that placeholder is controllable by the attacker.\n\ne.g.\n\n```go\nattackValue := `$tag$; drop table canary; --`\n_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)\n```\n\nThis is unlikely to occur outside of a contrived scenario.\n\n### Patches\n\nThe problem is resolved in v5.9.2.\n\n### Workarounds\n\nDo not use the simple protocol to execute queries matching all the above conditions.","state":0,"publishedAt":"2026-04-22T20:46:51+00:00","modifiedAt":"2026-09-10T03:51:02.2044568+00:00","affected":[{"ecosystem":"Go","name":"github.com/jackc/pgx/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.9.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/jackc/pgx/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"4.18.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/jackc/pgx","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"3.6.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx","https://nvd.nist.gov/vuln/detail/CVE-2026-41889","https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da","https://github.com/jackc/pgx","https://github.com/jackc/pgx/releases/tag/v5.9.2"],"sourceUrl":"https://github.com/advisories/GHSA-j88v-2chj-qfwx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j88v-2chj-qfwx","identifiers":["GHSA-j88v-2chj-qfwx","CVE-2026-41889","GO-2026-5004"]},"retained":false,"historicalAffected":[]}],"coverage":[]}