N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j88v-2chj-qfwx

GHSA-j88v-2chj-qfwx: pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Impact

SQL Injection can occur when:

The non-default simple protocol is used.
A dollar quoted string literal is used in the SQL query.
That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.
The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

Patches

The problem is resolved in v5.9.2.

Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j88v-2chj-qfwx

GHSA-j88v-2chj-qfwx:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/jackc/pgx/v5	go	< 5.9.2	5.9.2
github.com/jackc/pgx/v4	go	<= 4.18.3
github.com/jackc/pgx	go	<= 3.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the SQL injection vulnerability (GHSA-j88v-2chj-qfwx) in the jackc/pgx library is the improper handling of PostgreSQL-specific dollar-quoted string literals within the library's SQL sanitizer. This sanitizer is invoked when using the non-default simple query protocol.

The vulnerability resides in the lexer used for sanitization, specifically within the rawState function of the sqlLexer in internal/sanitize/sanitize.go. This function failed to recognize dollar-quoted strings (e.g., $$...$$ or $tag$...$tag$). As a result, if a placeholder like $1 appeared inside such a string, the sanitizer would incorrectly treat it as a parameter to be substituted, rather than as part of the literal string.

An attacker could exploit this by providing a specially crafted value for a query parameter. This value would be designed to close the dollar-quoted string from within, and then inject malicious SQL commands. For example, given a query like SELECT $tag$ $1 $tag$ and an attacker-controlled value for $1 of $tag$; DROP TABLE important_data; --, the sanitizer would produce a query that executes the malicious DROP TABLE command.

The patch addresses this by enhancing the lexer. It introduces a new state (dollarQuoteState) and logic (scanDollarQuoteTag) to correctly identify and parse dollar-quoted strings, ensuring their contents are treated as a single literal and not scanned for placeholders.

Additionally, the analysis of the patch revealed a secondary hardening improvement in the placeholderState function. This change prevents an integer overflow when parsing large placeholder numbers, which could have otherwise led to unpredictable behavior by aliasing arguments.

Vulnerable functions

sqlLexer.rawState

internal/sanitize/sanitize.go

The vulnerability lies in the SQL sanitizer's lexer. The `rawState` function, which is part of the lexer's state machine, did not correctly handle PostgreSQL's dollar-quoted string literals. When it encountered a '$' character, it would attempt to parse a placeholder like '$1', even if it was inside a string literal. This allowed an attacker to craft a placeholder value that could break out of the string and inject arbitrary SQL when the simple protocol was used. The patch adds logic to detect and correctly parse dollar-quoted strings, preventing placeholder substitution within them.

sqlLexer.placeholderState

internal/sanitize/sanitize.go

A secondary vulnerability existed in the `placeholderState` function. When parsing a placeholder number (e.g., '$123'), the code was susceptible to an integer overflow if the number was very large. This could cause the placeholder index to wrap around to a smaller, valid index, potentially leading to incorrect and insecure behavior where one argument could be substituted for another. The patch mitigates this by clamping the parsed number to a safe maximum value (`math.MaxInt32`).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.