pgx: SQL Injection via placeholder confusion with dollar quoted string literals

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-41889 · Microsoft / collected KEV context

EUVD-2026-28805

GHSA-j88v-2chj-qfwx

GO-2026-5004

cve-program · CVE-2026-41889

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx/releases/tag/v5.9.2

euvd · EUVD-2026-28805

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx/releases/tag/v5.9.2

nvd · CVE-2026-41889

• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx/releases/tag/v5.9.2
• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx

osv · GHSA-j88v-2chj-qfwx

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://nvd.nist.gov/vuln/detail/CVE-2026-41889
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx
• https://github.com/jackc/pgx/releases/tag/v5.9.2

osv · GO-2026-5004

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx/releases/tag/v5.9.2

No related operational record is retained in the current change model.