data/reports/GO-2026-5004.yaml

id: GO-2026-5004
modules:
    - module: github.com/jackc/pgx
      vulnerable_at: 3.6.2+incompatible
      packages:
        - package: github.com/jackc/pgx/internal/sanitize
          symbols:
            - SanitizeSQL
            - Query.Sanitize
    - module: github.com/jackc/pgx/v4
      vulnerable_at: 4.18.3
      packages:
        - package: github.com/jackc/pgx/v4/internal/sanitize
          symbols:
            - SanitizeSQL
            - Query.Sanitize
    - module: github.com/jackc/pgx/v5
      versions:
        - fixed: 5.9.2
      vulnerable_at: 5.9.1
      packages:
        - package: github.com/jackc/pgx/v5/internal/sanitize
          symbols:
            - SanitizeSQL
            - Query.Sanitize
summary: |-
    SQL Injection via placeholder confusion with dollar quoted string literals in
    github.com/jackc/pgx
description: |-
    SQL Injection can occur when using the non-default simple protocol with a dollar
    quoted string literal in the SQL query. If that string literal contains text
    that would be interpreted as a placeholder outside of a string literal, and the
    value of that placeholder is controllable by the attacker, an injection may be
    possible.

    For example, an attacker could provide a value that includes a closing dollar
    quote followed by malicious SQL commands. This is unlikely to occur outside of a
    contrived scenario.
cves:
    - CVE-2026-41889
ghsas:
    - GHSA-j88v-2chj-qfwx
credits:
    - Jack Christensen
references:
    - advisory: https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
    - fix: https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
    - web: https://github.com/jackc/pgx/releases/tag/v5.9.2
source:
    id: GHSA-j88v-2chj-qfwx
    created: 2026-05-21T09:29:52.747438-04:00
review_status: REVIEWED