The pgx driver for Go enables execution of SQL queries using a non‑default simple protocol. When a dollar quoted string literal is used, any placeholder within that literal may be misinterpreted as a separate placeholder if the string contains dollar signs. If an attacker can supply the value for that placeholder, arbitrary SQL can be injected. This flaw is identified as CWE‑89.

The issue affects the jackc:pgx PostgreSQL driver for Go, specifically all releases prior to version 5.9.2. The patch was released in v5.9.2; any application that uses the non‑default simple protocol and constructs queries with dollar quoted string literals is at risk.

The CVSS score of 2.3 indicates low severity, and no EPSS score is available. Exploitation requires the attacker to have control over the query contents to set a placeholder value, limiting its likelihood in the wild. The vulnerability is not listed in CISA's KEV catalog.