EUVD-2026-28805Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionGitHub Advisory
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.
AnalysisAI
SQL injection vulnerability in pgx (Go PostgreSQL driver) prior to version 5.9.2 allows authenticated attackers to manipulate queries when the non-default simple protocol is used in conjunction with dollar-quoted string literals containing attacker-controlled placeholder-like text. The vulnerability requires specific configuration (simple protocol mode enabled) and precise SQL structure (dollar-quoted strings with embedded placeholder syntax), making exploitation unlikely in typical deployments but possible in applications explicitly using QueryExecModeSimpleProtocol.
Technical ContextAI
pgx is a PostgreSQL driver for Go that supports multiple query execution modes. PostgreSQL uses dollar-quoted strings (syntax: $[tag]$...$[tag]$) as an alternative to standard single-quoted strings for handling content containing quotes. The vulnerability stems from the query sanitizer/parser in internal/sanitize/sanitize.go failing to properly recognize and skip placeholder substitution within dollar-quoted string literals when using the simple protocol mode. The simple protocol differs from the extended protocol by transmitting full SQL with parameter values inline rather than via separate bind operations. When a dollar-quoted string contains text matching PostgreSQL placeholder syntax (e.g., $1, $2), the sanitizer previously treated this as an actual placeholder and substituted the attacker-controlled parameter value, resulting in SQL injection. The fix implements proper lexical analysis of dollar-quoted strings by tracking the opening tag and only terminating the quoted region when the matching closing tag is encountered, preventing placeholder recognition within those boundaries. Additionally, overflow protection was added to handle pathologically large placeholder numbers.
RemediationAI
Vendor-released patch: pgx 5.9.2 or later. Users on pgx v5 should upgrade immediately to 5.9.2 using 'go get -u github.com/jackc/pgx/v5@v5.9.2'. Users on pgx v4 or v3 should migrate to pgx v5 and apply the patch, as no fix is available for older major versions. For applications unable to upgrade immediately, implement the primary workaround: disable the simple protocol mode by removing QueryExecModeSimpleProtocol from any Exec, Query, or Batch calls. Replace simple protocol invocations with the default extended protocol (omit the mode flag or explicitly use QueryExecModeExec for execution). This mitigation has no performance penalty in typical applications and is the recommended interim control. Alternatively, audit SQL queries to ensure no dollar-quoted strings are used in parameterized queries; rewrite dollar-quoted strings using standard PostgreSQL escaping. See GitHub Security Advisory GHSA-j88v-2chj-qfwx and release v5.9.2 for full context.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
## Summary An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query strin
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today