CVE-2024-27289

Name of the Vulnerable Software and Affected Versions pgx versions prior to 4.18.2

Description The issue is related to SQL injection in the pgx PostgreSQL driver and toolkit for Go. It occurs when the non-default simple protocol is used, a placeholder for a numeric value is immediately preceded by a minus, there is a second placeholder for a string value after the first placeholder on the same line, and both parameter values are user-controlled. This allows an attacker to execute arbitrary SQL queries.

Recommendations As a temporary workaround, do not use the simple protocol or do not place a minus directly before a placeholder. For versions prior to 4.18.2, update to version 4.18.2 to resolve the issue.