{"id":"CVE-2026-41889","aliases":["GHSA-j88v-2chj-qfwx","GO-2026-5004"],"url":"https://o3.security/vulnerability/CVE-2026-41889","summary":"pgx: SQL Injection via placeholder confusion with dollar quoted string literals","details":"### Impact\n\nSQL Injection can occur when:\n\n1. The non-default simple protocol is used.\n2. A dollar quoted string literal is used in the SQL query.\n3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.\n4. The value of that placeholder is controllable by the attacker.\n\ne.g.\n\n```go\nattackValue := `$tag$; drop table canary; --`\n_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)\n```\n\nThis is unlikely to occur outside of a contrived scenario.\n\n### Patches\n\nThe problem is resolved in v5.9.2.\n\n### Workarounds\n\nDo not use the simple protocol to execute queries matching all the above conditions.","published":"2026-05-08T15:53:00.251Z","modified":"2026-08-12T03:51:48.584734902Z","cvss":null,"epss":{"score":0.00356,"percentile":0.28566,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/jackc/pgx/v5","fixedVersion":"5.9.2"},{"ecosystem":"Go","name":"github.com/jackc/pgx/v4","fixedVersion":null},{"ecosystem":"Go","name":"github.com/jackc/pgx","fixedVersion":null}],"fix":{"url":"https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da","label":"jackc/pgx@60644f8"},"references":[{"type":"WEB","url":"https://github.com/jackc/pgx/releases/tag/v5.9.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41889.json"},{"type":"ADVISORY","url":"https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41889"},{"type":"FIX","url":"https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da"},{"type":"PACKAGE","url":"https://github.com/jackc/pgx"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:48.584734902Z"}}