pgx: SQL Injection via placeholder confusion with dollar quoted string literals
Priority LOW 12CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 3 fixed, 26 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.
Summary
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix Partial pgx (jackc): 5.9.2github.com/jackc/pgx/v5 (Go): 5.9.2Red Hat: 5 advisoriesRed Hat: 3 fixed, 26 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jackc | pgx | before 5.9.2 | 5.9.2 | Patch available | CNA |
| — | github.com/jackc/pgx/v5 (Go) | before 5.9.2 | 5.9.2 | Patch available | GHSA-j88v-2chj-qfwx |
| — | github.com/jackc/pgx/v4 (Go) | up to 4.18.3 | — | No fix listed | GHSA-j88v-2chj-qfwx |
| — | github.com/jackc/pgx (Go) | up to 3.6.2 | — | No fix listed | GHSA-j88v-2chj-qfwx |
- pgx Vendorjackc Affected before 5.9.2 Fixed in 5.9.2 Patch available CNA
- github.com/jackc/pgx/v5 (Go) Vendor— Affected before 5.9.2 Fixed in 5.9.2 Patch available GHSA-j88v-2chj-qfwx
- github.com/jackc/pgx/v4 (Go) Vendor— Affected up to 4.18.3 Fixed in — No fix listed GHSA-j88v-2chj-qfwx
- github.com/jackc/pgx (Go) Vendor— Affected up to 3.6.2 Fixed in — No fix listed GHSA-j88v-2chj-qfwx
Remediation
- Fix · CNA pgx (jackc) Fixed in 5.9.2
- Fix · GHSA-j88v-2chj-qfwx github.com/jackc/pgx/v5 (Go) Fixed in 5.9.2 Advisory →
Red Hat 5 advisories
- RHSA-2026:48913 Released 2026-07-30 · Red Hat rating ImportantRHACS 4.10.6 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator
- RHSA-2026:48872 Released 2026-07-30 · Red Hat rating ImportantRHACS 4.9.10 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8
- RHSA-2026:25138 Released 2026-06-10 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images cosign-3.1.1-0.1.hum1@aarch64, cosign-3.1.1-0.1.hum1@src, cosign-3.1.1-0.1.hum1@x86_64
Show 2 more Red Hat advisories
- RHSA-2026:16133 Released 2026-05-12 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images caddy-2.11.3-0.1.hum1@aarch64, caddy-2.11.3-0.1.hum1@src, caddy-2.11.3-0.1.hum1@x86_64
- RHSA-2026:15856 Released 2026-05-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images go-fdo-server-1.0.1-0.2.hum1@aarch64, go-fdo-server-1.0.1-0.2.hum1@src, go-fdo-server-1.0.1-0.2.hum1@x86_64 +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:48872 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:48913 |
| Red Hat Hardened Images | Fixed | RHSA-2026:15856, RHSA-2026:16133, RHSA-2026:25138 |
Not affected: 2 products
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41889
- 2026-10-03 Alias added: GHSA-j88v-2chj-qfwx
- 2026-11-06 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
References
More jackc Pgx vulnerabilities
- TI-2024-18128 pgx SQL Injection via Line Comment Creation CVSS 3.1HIGH 8.1
- TI-2026-26188 CVE-2026-33816 in github.com/jackc/pgx CVSS 3.1CRITICAL 9.8
- TI-2026-26187 CVE-2026-33815 in github.com/jackc/pgx CVSS 3.1CRITICAL 9.8
- TI-2024-18142 pgx SQL Injection via Protocol Message Size Overflow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-41889 · CVE Program
- CVE-2026-41889 · NVD
- FIRST EPSS
- GHSA-j88v-2chj-qfwx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41889 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences