CVE Intelligence
Analysis AI-assisted

CVE-2026-41889: pgx: SQL injection via placeholder confusion with dollar-quoted string literals

pgx, a PostgreSQL driver and toolkit for Go, is affected by an SQL injection weakness when the non-default simple protocol is used. The issue arises when a dollar-quoted string literal in a query contains text read as a placeholder whose value an attacker can control. The record states the issue is patched in version 5.9.2.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

pgx is a PostgreSQL driver and toolkit for Go. This record describes an SQL injection weakness (CWE-89) that arises when the non-default simple protocol is used and a dollar-quoted string literal in a query contains text interpreted as a placeholder whose value is attacker-controllable.

Impact

  • The record classifies the issue as SQL injection, which can allow an attacker to alter the intended structure of a database query.
  • NVD lists a base score of 9.8 (critical). GitHub as a CNA lists a lower score of 2.3.
  • The specific data exposure or integrity impact in a given deployment is unknown from the record.

Affected products and versions

  • Product: pgx (Jackc Pgx).
  • Affected: before 5.9.2.
  • Fixed: 5.9.2, as stated in the record.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • EPSS lists a probability of 0.00488 and a percentile of 0.41138.

Remediation and mitigation

  • Upgrade pgx to 5.9.2 or later, the version the record identifies as fixed.
  • Review the vendor advisory for the mitigation guidance it provides.
  • Confirm that the patch commit is included in the build deployed to production.
  • As a general defensive practice, keep untrusted input out of SQL text and review how queries are assembled in Go services.

Detection guidance

  • Inventory Go applications and dependencies that import pgx and record the versions in use.
  • Review code paths that use the simple protocol or build SQL text containing dollar-quoted literals.
  • Watch database logs for unexpected query errors or structure coming from application accounts, as a general signal.

Limitations of the available information

  • The record does not describe the conditions of an attack in detail, and this analysis does not provide them.
  • The record does not state whether default configurations are affected.
  • Whether other products or distributions that bundle pgx are affected is unknown.
  • The two CVSS sources differ, and the record does not explain the difference.

Frequently asked questions

Which pgx versions are affected by CVE-2026-41889?

The record lists pgx versions before 5.9.2 as affected. Version 5.9.2 is identified as the fixed version.

Does the issue affect every pgx user?

Not necessarily. The record says the issue requires the non-default simple protocol, a dollar-quoted string literal in the query, and an attacker-controllable placeholder value. Whether default configurations are affected is not stated.

Is this vulnerability known to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.