StackRadar

CVE-2026-41889

Low

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.3
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
308
of 17,781 indexed, latest versions
Container images
324
deployed by those charts
Fix available
1 of 3
affected packages

pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Carried by container images the latest versions of 308 of 17,781 indexed charts deploy, on 324 images.

Affected packageAffected versionsFixed inImages
github.com/jackc/pgx/v5golangv5.0.4, v5.2.0, v5.3.0, v5.3.1+17 more5.9.2186
github.com/jackc/pgx/v4golangv4.6.0, v4.7.1, v4.8.1, v4.8.2-0.20200910143026-040df1ccef85+14 moreno fix listed139
github.com/jackc/pgxgolangv3.1.1-0.20180608201956-39bbc98d99d7+incompatible, v3.2.0+incompatible, v3.3.0+incompatible, v3.6.0+incompatible+1 moreno fix listed16
OSV records
GHSA-j88v-2chj-qfwx
Also known as
GO-2026-5004

Charts affected

308 by stars
ChartLatestAffected imagesRadar Score
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/jackc/pgx/v5@v5.7.6
5.9.2

Open the chart page →

4,526
twitter-apptwitter-helm0.1.121 of 8See more

twitter-app twitter-helm 0.1.12

1 of the 8 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
stakkato95/twitter-service-tweets:0.1.18412d8a8cac3
github.com/jackc/pgx/v4@v4.16.0
no fix listed

Open the chart page →

6,132
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
github.com/jackc/pgx@v3.6.0+incompatible
no fix listed

Open the chart page →

13,459
gateway-control-planewallarmVerified publisher0.2.02 of 2See more

gateway-control-plane wallarm 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg17bc8527e62f70
github.com/jackc/pgx/v5@v5.7.2
5.9.2
wallarm/gateway-control-plane:0.2.0a321bc974a19
github.com/jackc/pgx/v5@v5.8.0
5.9.2

Open the chart page →

1,455
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/jackc/pgx/v5@v5.7.5
5.9.2

Open the chart page →

969
wexa-studiowexa-studio1.2.03 of 15See more

wexa-studio wexa-studio 1.2.0

3 of the 15 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/jackc/pgx@v3.3.0+incompatible
github.com/jackc/pgx/v4@v4.18.1
no fix listed
no fix listed
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
github.com/jackc/pgx/v5@v5.7.4
5.9.2
temporalio/server:1.29.1c1e3326b2ce1
github.com/jackc/pgx/v5@v5.7.4
5.9.2

Open the chart page →

14,983
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/jackc/pgx/v4@v4.18.1
no fix listed

Open the chart page →

2,022
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-41889.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/jackc/pgx/v5@v5.7.1
5.9.2

Open the chart page →

9,381

Container images carrying it

324 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/cncf/gitvote/dbmigrator:v1.5.0f1e7efe440da
github.com/jackc/pgx/v4@v4.7.1
no fix listed
1
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
github.com/jackc/pgx/v5@v5.7.6
5.9.2
1
ghcr.io/erpc/erpc:0.1.18bfed3d49a08
github.com/jackc/pgx/v4@v4.18.3
no fix listed
1
ghcr.io/erpc/erpc:0.0.49f5654f745d4c
github.com/jackc/pgx/v4@v4.18.3
no fix listed
1
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
github.com/jackc/pgx/v5@v5.6.0
5.9.2
1
ghcr.io/ferretdb/ferretdb:2.7.05706414241eb
github.com/jackc/pgx/v5@v5.7.6
5.9.2
1
ghcr.io/flatcar/nebraska:4.0.05c9e99ff7167
github.com/jackc/pgx/v4@v4.18.3
no fix listed
1
ghcr.io/formancehq/ledger:v1.9.203c1ddbda33b
github.com/jackc/pgx/v4@v4.17.2
no fix listed
1
ghcr.io/formancehq/membership:v1.11.024a0113d5fb0
github.com/jackc/pgx/v5@v5.7.5
5.9.2
1
ghcr.io/gabe565/limo:latest6dfdbc9853bb
github.com/jackc/pgx/v5@v5.3.0
5.9.2
1
ghcr.io/glassflow/glassflow-etl-migration:v3.2.07db1a1bf3dae
github.com/jackc/pgx/v4@v4.18.2
github.com/jackc/pgx/v5@v5.5.4
no fix listed
5.9.2
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
github.com/jackc/pgx/v5@v5.8.0
5.9.2
1
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
github.com/jackc/pgx/v5@v5.6.0
5.9.2
1
ghcr.io/huseyinbabal/kubetag:lateste161eddc59a0
github.com/jackc/pgx/v5@v5.7.6
5.9.2
1
ghcr.io/imcitius/checker-edge:1.1.1174426c1fe00f
github.com/jackc/pgx/v5@v5.8.0
5.9.2
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/jackc/pgx/v5@v5.6.0
5.9.2
1
ghcr.io/juanfont/headscale:v0.25.097febecbe6cb
github.com/jackc/pgx/v5@v5.7.1
5.9.2
1
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
github.com/jackc/pgx/v4@v4.18.3
no fix listed
1
ghcr.io/kedacore/keda:2.16.002348a19aeae
github.com/jackc/pgx/v5@v5.7.1
5.9.2
1
ghcr.io/kedacore/keda:2.17.0112fc427d933
github.com/jackc/pgx/v5@v5.7.4
5.9.2
1
ghcr.io/kedacore/keda:2.17.272dc058e478d
github.com/jackc/pgx/v5@v5.7.4
5.9.2
1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
github.com/jackc/pgx/v5@v5.7.4
5.9.2
1
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
github.com/jackc/pgx/v5@v5.7.1
5.9.2
1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.2f312f50ddc57
github.com/jackc/pgx/v5@v5.7.4
5.9.2
1
ghcr.io/kikplate/kikplate-api:main2fbce0601a3c
github.com/jackc/pgx/v5@v5.6.0
5.9.2
1
ghcr.io/loafoe/caddy-token:v0.3.0528f2174fa2f
github.com/jackc/pgx/v4@v4.18.3
no fix listed
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/jackc/pgx/v4@v4.18.0
no fix listed
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
github.com/jackc/pgx/v5@v5.8.0
5.9.2
1
ghcr.io/netsoc/iamd:1.1.22fe6b69b20d7
github.com/jackc/pgx/v4@v4.10.1
no fix listed
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
github.com/jackc/pgx/v5@v5.7.3
5.9.2
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
github.com/jackc/pgx/v5@v5.7.3
5.9.2
1
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
github.com/jackc/pgx/v4@v4.17.2
no fix listed
1
ghcr.io/openfaasltd/postgres-connector:0.2.3379e583a0a75
github.com/jackc/pgx@v3.6.2+incompatible
no fix listed
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/jackc/pgx/v5@v5.7.6
5.9.2
1
ghcr.io/opnpulse/perses:v2026.4.24b880da90aa1a
github.com/jackc/pgx/v5@v5.7.5
5.9.2
1
ghcr.io/pbufio/registry:v0.4.177a36c035b4b
github.com/jackc/pgx/v5@v5.7.6
5.9.2
1
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
github.com/jackc/pgx/v5@v5.7.2
5.9.2
1
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
github.com/jackc/pgx/v5@v5.9.1
5.9.2
1
ghcr.io/qjoly/spindle:v1.16.1-alphaaab0c99d313f
github.com/jackc/pgx/v5@v5.8.0
5.9.2
1
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
github.com/jackc/pgx/v4@v4.15.0
no fix listed
1
ghcr.io/riverqueue/riverui:0.5.32dc54179b25a
github.com/jackc/pgx/v5@v5.6.0
5.9.2
1
ghcr.io/sergelogvinov/postgresql:16.15fafb72e98f22
github.com/jackc/pgx/v4@v4.8.1
github.com/jackc/pgx/v5@v5.8.0
no fix listed
5.9.2
1
ghcr.io/strrl/wonder-mesh-net:v2026.629.0625b140372fd
github.com/jackc/pgx/v5@v5.8.0
5.9.2
1
ghcr.io/substra/orchestrator-server:1.0.0647e45284a80
github.com/jackc/pgx/v4@v4.18.1
github.com/jackc/pgx/v5@v5.3.1
no fix listed
5.9.2
1
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/jackc/pgx/v4@v4.18.3
no fix listed
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
github.com/jackc/pgx/v5@v5.7.6
5.9.2
1
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/jackc/pgx/v4@v4.18.3
no fix listed
1
public.ecr.aws/cloudnatix/llmariner/database-creator:1.19.162375abc3c56
github.com/jackc/pgx/v5@v5.5.5
5.9.2
1
public.ecr.aws/cloudnatix/llmariner/database-creator:1.17.097065ced2942
github.com/jackc/pgx/v5@v5.5.5
5.9.2
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/jackc/pgx/v4@v4.17.2
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.