CVE-2024-27289: Jackc Pgx SQLi Vulnerability

CVE-2024-27289 Overview

CVE-2024-27289 is a SQL injection vulnerability in pgx, a widely used PostgreSQL driver and toolkit for Go. The flaw affects all versions prior to 4.18.2 and stems from improper sanitization in the simple protocol query path. An attacker can inject malicious SQL when a numeric placeholder is immediately preceded by a minus sign and followed by a second, user-controlled string placeholder on the same line. The injected payload exploits SQL line comment semantics to alter the executed statement. The issue is tracked under [CWE-89: SQL Injection] and fixed in pgxv4.18.2.

Critical Impact

Successful exploitation allows attackers to execute arbitrary SQL against the backing PostgreSQL database, enabling data theft, modification, or destruction when applications use the simple protocol with user-controlled parameters.

Affected Products

• jackc/pgx versions prior to 4.18.2
• Go applications using the non-default simple protocol with pgx
• Downstream Go libraries and services that depend on vulnerable pgx releases

Discovery Timeline

• 2024-03-06 - CVE-2024-27289 published to NVD
• 2024-03-06 - jackc publishes GitHub Security Advisory GHSA-m7wr-2xf7-cm9p and patch commit f94eb0e
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2024-27289

Vulnerability Analysis

The pgx driver offers two query modes: the default extended protocol, which sends parameters separately from the SQL text, and the simple protocol, which inlines parameters after client-side sanitization. The vulnerability resides in the simple-protocol sanitizer at internal/sanitize/sanitize.go. When a negative numeric argument was rendered directly into the query string and immediately preceded by a - character, the resulting -- sequence formed a SQL line comment. Any text following on the same line, including a subsequent string placeholder, was treated as commented-out code by PostgreSQL, breaking parameter boundaries and allowing a second user-controlled value to be reinterpreted as SQL.

Root Cause

The sanitizer formatted int64 and float64 arguments using strconv.FormatInt and strconv.FormatFloat without consistently wrapping the value in parentheses. A negative value such as -1 substituted next to a preceding - operator produced --1, which PostgreSQL parses as the start of a single-line comment. The fix always wraps numeric arguments in parentheses, preventing comment formation regardless of adjacent characters.

Attack Vector

Exploitation requires the application to use the simple protocol and to construct a query where a minus sign sits immediately before a numeric placeholder, followed by a string placeholder on the same line, with both values attacker-controlled. By supplying a negative integer and a crafted string, the attacker collapses the second placeholder into a comment-injected payload that terminates the comment and appends arbitrary SQL.

// Source: https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
// Patch in internal/sanitize/sanitize.go - the fix removes the conditional
// parenthesization and always wraps numeric arguments in parentheses.

				str = "null"
			case int64:
				str = strconv.FormatInt(arg, 10)
-				// Prevent SQL injection via Line Comment Creation
-				// https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p
-				if arg < 0 {
-					str = "(" + str + ")"
-				}
			case float64:
-				// Prevent SQL injection via Line Comment Creation
-				// https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p
				str = strconv.FormatFloat(arg, 'f', -1, 64)
-				if arg < 0 {
-					str = "(" + str + ")"
-				}
			case bool:
				str = strconv.FormatBool(arg)
			case []byte:

For a detailed write-up of the comment-injection technique, see the SonarSource blog on double-dash SQL injection.

Detection Methods for CVE-2024-27289

Indicators of Compromise

• PostgreSQL query logs containing -- sequences immediately followed by SQL keywords such as UNION, SELECT, DROP, or ;
• Application requests where numeric parameters carry negative values adjacent to string parameters in the same query
• Unexpected database errors or schema enumeration originating from endpoints that use the pgx simple protocol

Detection Strategies

• Inventory Go services and dependencies for github.com/jackc/pgx versions below 4.18.2 using go list -m all or software composition analysis tools
• Audit application code for QuerySimpleProtocol, PreferSimpleProtocol, or QueryExecModeSimpleProtocol usage with user-supplied numeric and string arguments
• Enable PostgreSQL log_statement = 'all' in non-production environments to inspect rendered SQL for malformed comment patterns

Monitoring Recommendations

• Forward PostgreSQL and application logs to a centralized analytics platform and alert on anomalous query structures originating from web tiers
• Track outbound query volume and result sizes from services using pgx to flag potential data exfiltration
• Correlate web application firewall events with database query patterns to identify injection attempts in transit

How to Mitigate CVE-2024-27289

Immediate Actions Required

• Upgrade github.com/jackc/pgx/v4 to v4.18.2 or later across all Go modules and rebuild dependent services
• Identify and refactor code paths that explicitly enable the simple protocol and review them for unsafe placeholder adjacency
• Rotate database credentials if logs indicate successful exploitation attempts predating the patch

Patch Information

The fix is delivered in pgxv4.18.2 via commit f94eb0e2f96782042c96801b5ac448f44f0a81df. The patch unconditionally wraps int64 and float64 arguments in parentheses inside internal/sanitize/sanitize.go, eliminating the -- line-comment construction regardless of surrounding query text. Full advisory details are available in GHSA-m7wr-2xf7-cm9p.

Workarounds

• Stop using the simple protocol and rely on the default extended protocol, which transmits parameters out-of-band
• Avoid placing a minus sign directly before any placeholder in SQL templates handled by the simple protocol
• Validate and constrain user input types so numeric parameters cannot carry negative values when combined with adjacent string placeholders

# Upgrade pgx to the patched release
go get github.com/jackc/pgx/v4@v4.18.2
go mod tidy

# Verify the resolved version
go list -m github.com/jackc/pgx/v4