CVE-2026-41889Disclosure(jackc / pgx)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

jackc CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da

Vendor / third-party advisories

https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx

Other references

https://github.com/jackc/pgx/releases/tag/v5.9.2

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-05-08); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

jackc

Products

pgx

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-41889

Full discourse2 posts

yerliJHON@yerli_jhon151d
Disclosure
Go'nun pgx kütüphanesinde dollar-quoted string ile placeholder karışıyor, SQL injection doğuyor. "Go yazdım, memory safe" diyenler SQL injection'dan da korunduğunu sanıyordu herhalde. Dil güvenli olabilir, developer değil. CVE-2026-41889
Post summary
The post discloses that a flaw in Go's pgx library (CVE-2026-41889) allows dollar‑quoted strings to corrupt parameter placeholders, resulting in SQL injection. No evidence of active exploitation, PoC, or patch is provided.
0000029
View on X
CVE@CVEnew153d
Disclosure
CVE-2026-41889 pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string li… https://www.cve.org/CVERecord?id=CVE-2026-41889
Post summary
The excerpt announces a SQL injection flaw in pgx versions prior to 5.9.2, triggered by the non‑default simple protocol and dollar quoted strings, without providing PoC or exploit details or a mitigation.
0000050
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	jackc	pgx	-	go	-

Explore more

Back to dashboard jackc CVEs pgx vulnerabilities