# CVE-2026-41889: jackc pgx SQL injection in simple protocol sanitizer

Source: https://junglewise.ai/threats/cve-2026-41889-jackc-pgx-sql-injection-in-simple-protocol-sanitizer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-41889 · Severity: critical · CVSS 9.8 · Published 2026-05-08

pgx is a popular Go library used by developers to connect applications to PostgreSQL databases. A vulnerability exists where specially crafted database queries can bypass security protections, allowing an attacker to execute unauthorized commands. This could lead to the theft of sensitive data, modification of database records, or a complete shutdown of the database service.

Technologies: [github.com/jackc/pgx (Go)](https://junglewise.ai/threats/technologies/github-com-jackc-pgx), [github.com/jackc/pgx/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-jackc-pgx-v4), [github.com/jackc/pgx/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-jackc-pgx-v5), [Jack Christensen Pgx](https://junglewise.ai/threats/technologies/pgx). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Jack Christensen](https://junglewise.ai/threats/vendors/jack-christensen).

## Quick answers

**Is CVE-2026-41889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41889 being exploited in the wild.

**How severe is CVE-2026-41889?** Critical severity, with a CVSS score of 9.8, published 8 May 2026.

**Which products and versions are affected?** github.com/jackc/pgx (Go) <= 3.6.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.6.2; github.com/jackc/pgx/v4 (Go) <= 4.18.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=4.18.3; github.com/jackc/pgx/v5 (Go) < 5.9.2, SEMVER:introduced=0,fixed=5.9.2; Jack Christensen Pgx < 5.9.2; and 2 more.

**Is there a fix for CVE-2026-41889?** Yes. github.com/jackc/pgx/v5 (Go): upgrade to 5.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41889 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41889?** Check whether you run github.com/jackc/pgx (Go), github.com/jackc/pgx/v4 (Go), github.com/jackc/pgx/v5 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/jackc/pgx/v5 (Go): upgrade to 5.9.2 or later

  ```sh
  go get github.com/jackc/pgx/v5@v5.9.2
  ```


## Technical details

A SQL injection vulnerability exists in the pgx driver's simple-protocol SQL sanitizer. The sanitizer incorrectly identifies placeholder patterns (e.g., $1) inside PostgreSQL dollar-quoted string literals ($$...$$ or $tag$...$tag$) as actual placeholders. An attacker who can control the value of a placeholder can provide a payload that closes the dollar-quoted string and appends arbitrary SQL commands. Additionally, the lexer failed to properly handle placeholder overflow, which could lead to argument aliasing. The issue is fixed in version 5.9.2 by updating the lexer to recognize dollar-quoted tags and clamping placeholder numbers at MaxInt32.

## Affected products

- jackc pgx < 5.9.2

## Identifiers

- CVE-2026-41889
- GHSA-j88v-2chj-qfwx
- GO-2026-5004

## Timeline

- 2026-04-19: patched: Fixed in version 5.9.2
- 2026-05-08: disclosed: Initial CVE publication

## References

- [https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da](https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da)
- [https://github.com/jackc/pgx/releases/tag/v5.9.2](https://github.com/jackc/pgx/releases/tag/v5.9.2)
- [https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx](https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx)

## Related threats

- [jackc pgx memory safety vulnerability in pgproto3](https://junglewise.ai/threats/cve-2026-33816-jackc-pgx-memory-safety-vulnerability-in-pgproto3)
- [Jackc pgx memory-safety vulnerability in pgproto3](https://junglewise.ai/threats/cve-2026-33815-jackc-pgx-memory-safety-vulnerability-in-pgproto3)
- [Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx](https://junglewise.ai/threats/panic-in-pipeline-when-pgconn-is-busy-or-closed-in-github-com-jackc-pgx-b06ba063)
- [GO-2024-2567 - Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx](https://junglewise.ai/threats/go-2024-2567-panic-in-pipeline-when-pgconn-is-busy-or-closed-in-github-8819cd3b)
- [GO-2024-2606 - SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx](https://junglewise.ai/threats/cve-2024-27304-pgproto3-sql-injection-via-protocol-message-size-overflow)