Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jackc/pgx
master @ 7fd58a7
5
Fixes
5
CVEs
CRITICAL
Peak severity
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
pgconn: most-fixed (3 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SQL Injection: The simple-protocol query sanitizer has historically failed to handle dollar-quoted string literals and placeholder index limits correctly, resulting in critical SQL injection vulnerabilities such as CVE-2026-41889. Attackers controlling placeholder values can bypass sanitization to execute arbitrary database commands.
Information Disclosure: Attackers who control connection string arguments can manipulate sensitive parameters (e.g., servicefile, sslkey) to read local files or leak credentials if the parser does not restrict allowed keys.
Cleartext Transmission of Sensitive Information: Without strict client-side verification of allowed authentication mechanisms, the driver is susceptible to connection downgrade attacks where a malicious or compromised gateway forces the client to transmit credentials in cleartext.