CVE-2024-27289

8.1 highEPSS 0.8%

High (8.1) in jackc pgx. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/jackc/pgx 4.18.2.

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jackc:pgx

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-m7wr-2xf7-cm9p	Go	github.com/jackc/pgx	<4.18.2	4.18.2
GHSA-m7wr-2xf7-cm9p	Go	github.com/jackc/pgx/v4	<4.18.2	4.18.2
GO-2024-2605	Go	github.com/jackc/pgx	all versions	no fix published
GO-2024-2605	Go	github.com/jackc/pgx/v4	<4.18.2	4.18.2

References

Check your stack JSON