CVE-2026-41889 is a SQL injection flaw in pgx, the Go PostgreSQL driver, before version 5.9.2. NVD scores it 9.8, while the project calls it Moderate because it needs a narrow set of conditions. Upgrade pgx to 5.9.2 or later.
What's affected
Per the GitHub advisory for the Go module github.com/jackc/pgx, versions before 5.9.2 are affected and 5.9.2 is the patched release. SQL injection can occur only when all of these are true:
- The non-default simple protocol is used.
- A dollar quoted string literal appears in the SQL query.
- That literal contains text that would be read as a placeholder outside of a string literal.
- The value of that placeholder is controllable by the attacker.
The advisory says this is unlikely to occur outside of a contrived scenario.
How to check if you're exposed
go list -m github.com/jackc/pgx/v5
Then search for use of the simple protocol, which shows up as the QueryExecModeSimpleProtocol option in code, or as a default query mode setting in connection configuration. Also search your SQL strings for dollar quoting, such as $tag$. If neither appears, you are almost certainly outside the conditions. Reachability analysis helps here: the free dependency scan shows where pgx sits, and a reachability check shows whether code paths call it in the risky mode.
What to do now
- Upgrade to pgx 5.9.2 or later with
go get github.com/jackc/pgx/v5@v5.9.2andgo mod tidy. - Rebuild and redeploy.
- Until then, do not use the simple protocol to run queries that meet all the listed conditions, as the advisory advises.
- Prefer the default extended protocol with bound parameters, which this bug does not touch.
Why it matters
The record lists CWE-89, SQL injection. In the simple protocol, the driver substitutes parameter values into the SQL text on the client side. If its placeholder parser mistakes text inside a dollar quoted literal for a placeholder, it can alter the statement.
This is a good case to compare the numbers. NVD rates the worst case, while the project rates the practical case. Both matter: the fix is cheap, and the reachability question tells you how fast to move. The record does not flag this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
We use pgx with the default settings. Affected?
The simple protocol is not the default, so the stated conditions are unlikely to hold. Still upgrade, since it is a small change.
Sources
Last reviewed: 19 October 2026.
