CVE-2024-27289

What it actually does

SQL injection in pgx Go driver occurs when simple protocol is enabled and a numeric placeholder is immediately preceded by a minus sign on the same line as a following string placeholder, allowing user-controlled values to alter the executed query structure.

Why it matters to the business

Attackers could read, modify, or delete sensitive database records, potentially causing data breaches, service disruption, or regulatory penalties; the issue affects applications on Debian systems until patched packages are deployed.

How an attack unfolds

An attacker supplies crafted input that places a minus directly before a numeric placeholder followed by a string placeholder on the same line while the application uses the non-default simple protocol, causing the driver to concatenate values into the query and execute attacker-controlled SQL commands.

How to fix it

Upgrade pgx to version 4.18.2 or later; on Debian 12 update to package version 6.1.106-1. As a workaround avoid the simple protocol or ensure no minus sign appears directly before a placeholder.

How to confirm the fix worked

Inspect go.mod or vendor files for pgx version 4.18.2+, confirm Debian packages are at 6.1.106-1, and test application queries with crafted minus-prefixed numeric placeholders under the simple protocol to verify injection is blocked.

Typical attack path

1. Locate an application using pgx with the simple protocol enabled
2. Identify query patterns containing a minus immediately before a numeric placeholder followed by a string placeholder on the same line
3. Submit user-controlled values that break out of the intended query structure
4. Execute arbitrary SQL to read, modify, or delete data

How to detect it

Review database query logs and application request logs for SQL statements containing unexpected commands or syntax after numeric placeholders that were preceded by a minus sign; correlate with application code paths using the simple protocol.

What your security team should do

• Immediately upgrade pgx to 4.18.2 and apply Debian 6.1.106-1 updates across all environments
• Audit code for simple-protocol usage and refactor to the extended protocol where possible
• Add input sanitization and query parameterization reviews to prevent similar placeholder misuse
• Monitor EPSS and exploit maturity indicators for any future increase in observed attacks