Vulnerability advisory
GHSA-j88v-2chj-qfwx
pgx: SQL Injection via placeholder confusion with dollar quoted string literals
Also known as CVE-2026-41889GO-2026-5004
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 5.9.2 | 5.9.2 |
| Affected | Fixed in |
|---|---|
All versions through 4.18.3 | No fix listed |
| Affected | Fixed in |
|---|---|
All versions through 3.6.2 | No fix listed |
Description
Impact
SQL Injection can occur when:
- The non-default simple protocol is used.
- A dollar quoted string literal is used in the SQL query.
- That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.
- The value of that placeholder is controllable by the attacker.
e.g.
attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)
This is unlikely to occur outside of a contrived scenario.
Patches
The problem is resolved in v5.9.2.
Workarounds
Do not use the simple protocol to execute queries matching all the above conditions.