CVE-2026-41889 Details
Description
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.
A SQL injection vulnerability has been identified in the pgx PostgreSQL driver for Go, affecting versions prior to 5.9.2. The issue arises when the non-default simple protocol is used, and a dollar-quoted string literal is included in the SQL query. If the string literal contains text that could be interpreted as a placeholder outside of a string literal, and the placeholder's value is controllable by the attacker, exploitation is possible. This vulnerability has been patched in version 5.9.2.
Users can update to pgx version 5.9.2 or later to address this vulnerability. Instructions for downloading the latest version are available on the pgx GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da | [email protected] | Patch |
| https://github.com/jackc/pgx/releases/tag/v5.9.2 | [email protected] | Release Notes |
| https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jackc pgx | < 5.9.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Reanalysis | [email protected] |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |