Executive brief
pgx is a popular Go library used by developers to connect applications to PostgreSQL databases. A vulnerability exists where specially crafted database queries can bypass security protections, allowing an attacker to execute unauthorized commands. This could lead to the theft of sensitive data, modification of database records, or a complete shutdown of the database service.
Technical details
A SQL injection vulnerability exists in the pgx driver's simple-protocol SQL sanitizer. The sanitizer incorrectly identifies placeholder patterns (e.g., $1) inside PostgreSQL dollar-quoted string literals ($...$ or $tag$...$tag$) as actual placeholders. An attacker who can control the value of a placeholder can provide a payload that closes the dollar-quoted string and appends arbitrary SQL commands. Additionally, the lexer failed to properly handle placeholder overflow, which could lead to argument aliasing. The issue is fixed in version 5.9.2 by updating the lexer to recognize dollar-quoted tags and clamping placeholder numbers at MaxInt32.
Affected products
- jackc pgx < 5.9.2
Timeline
- 2026-04-19: patched: Fixed in version 5.9.2
- 2026-05-08: disclosed: Initial CVE publication