{"id":"GO-2026-5004","revision":"bdeb7879531842d6b0bb8c032921feb5","records":[{"revision":"bdeb7879531842d6b0bb8c032921feb5","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5004","aliases":["CVE-2026-41889","GHSA-j88v-2chj-qfwx"],"title":"SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx","description":"SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible.\n\nFor example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario.","state":0,"publishedAt":"2026-06-22T18:40:49+00:00","modifiedAt":"2026-06-25T18:45:14.9639127+00:00","affected":[{"ecosystem":"Go","name":"github.com/jackc/pgx","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/jackc/pgx/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/jackc/pgx/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.9.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx","https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da","https://github.com/jackc/pgx/releases/tag/v5.9.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5004","license":"OSV · upstream source license applies","key":"osv:GO-2026-5004","identifiers":["GO-2026-5004","CVE-2026-41889","GHSA-j88v-2chj-qfwx"]},"retained":false,"historicalAffected":[]}],"coverage":[]}