Vulnerability advisory

GO-2026-5004

SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx

Published Jun 22, 2026Updated Jun 25, 2026OSV record ↗

Also known as CVE-2026-41889GHSA-j88v-2chj-qfwx

Severity

Severity not reported.

Affected versions

github.com/jackc/pgx Go

All github.com/jackc/pgx advisories →

Affected	Fixed in
All versions	No fix listed

github.com/jackc/pgx/v4 Go

All github.com/jackc/pgx/v4 advisories →

Affected	Fixed in
All versions	No fix listed

github.com/jackc/pgx/v5 Go

All github.com/jackc/pgx/v5 advisories →

Affected	Fixed in
All versions before 5.9.2	`5.9.2`

Description

SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible.

For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario.