CVE-2024-27289 pgx SQL Injection via Line Comment Creation

What is CVE-2024-27289?

CVE-2024-27289 is a high-severity SQL injection vulnerability in jackc pgx, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder.

Weakness: CWE-89

Which versions are affected by CVE-2024-27289?

6 open source packages ship an affected version, including github.com/jackc/pgx and github.com/jackc/pgx/v4. It affects 1 product.

Products include Jackc Pgx.

How do I fix CVE-2024-27289?

Upgrade github.com/jackc/pgx to 4.18.2 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-27289 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27289 exists.

Other vulnerabilities in jackc pgx

• CVE-2026-33815 CVE-2026-33815 in github.com/jackc/pgx Critical 9.8
• CVE-2026-33816 CVE-2026-33816 in github.com/jackc/pgx Critical 9.8
• CVE-2026-41889 pgx: SQL Injection via placeholder confusion with dollar quoted string literals Low 2.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-35750, AZL-35763, CLEANSTART-2026-DM54086, CLEANSTART-2026-EY15087, DEBIAN-CVE-2024-27289, GHSA-m7wr-2xf7-cm9p and 2 more.