{"schema_version":"1.7.5","id":"GHSA-j88v-2chj-qfwx","published":"2026-04-22T20:46:51Z","modified":"2026-06-25T18:56:34.090855633Z","aliases":["CVE-2026-41889","GO-2026-5004"],"related":["CGA-rrgr-7xqx-rg3q"],"summary":"pgx: SQL Injection via placeholder confusion with dollar quoted string literals","details":"### Impact\n\nSQL Injection can occur when:\n\n1. The non-default simple protocol is used.\n2. A dollar quoted string literal is used in the SQL query.\n3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.\n4. The value of that placeholder is controllable by the attacker.\n\ne.g.\n\n```go\nattackValue := `$tag$; drop table canary; --`\n_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)\n```\n\nThis is unlikely to occur outside of a contrived scenario.\n\n### Patches\n\nThe problem is resolved in v5.9.2.\n\n### Workarounds\n\nDo not use the simple protocol to execute queries matching all the above conditions.","affected":[{"package":{"name":"github.com/jackc/pgx/v5","ecosystem":"Go","purl":"pkg:golang/github.com/jackc/pgx/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-j88v-2chj-qfwx/GHSA-j88v-2chj-qfwx.json"}},{"package":{"name":"github.com/jackc/pgx/v4","ecosystem":"Go","purl":"pkg:golang/github.com/jackc/pgx/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.18.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-j88v-2chj-qfwx/GHSA-j88v-2chj-qfwx.json"}},{"package":{"name":"github.com/jackc/pgx","ecosystem":"Go","purl":"pkg:golang/github.com/jackc/pgx"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.6.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-j88v-2chj-qfwx/GHSA-j88v-2chj-qfwx.json"}}],"references":[{"type":"WEB","url":"https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41889"},{"type":"WEB","url":"https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da"},{"type":"PACKAGE","url":"https://github.com/jackc/pgx"},{"type":"WEB","url":"https://github.com/jackc/pgx/releases/tag/v5.9.2"}],"database_specific":{"cwe_ids":["CWE-89"],"github_reviewed":true,"github_reviewed_at":"2026-04-22T20:46:51Z","nvd_published_at":"2026-05-08T17:16:31Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}