GO-2026-5004

Dashboard / Vulnerabilities / GO-2026-5004

GO-2026-5004

Summary: SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx

Details: SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario.

References: https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx, https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da, https://github.com/jackc/pgx/releases/tag/v5.9.2