CVE-2026-41889
LowAdvisory
Published 22 Apr 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 2.3
- base score, highest
- EPSS
- 0.004
- 29th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 308
- of 17,781 indexed, latest versions
- Container images
- 324
- deployed by those charts
- Fix available
- 1 of 3
- affected packages
pgx: SQL Injection via placeholder confusion with dollar quoted string literals
Carried by container images the latest versions of 308 of 17,781 indexed charts deploy, on 324 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v5.0.4, v5.2.0, v5.3.0, v5.3.1+17 more | 5.9.2 | 186 |
| github.com/ | v4.6.0, v4.7.1, v4.8.1, v4.8.2-0.20200910143026-040df1ccef85+14 more | no fix listed | 139 |
| github.com/ | v3.1.1-0.20180608201956-39bbc98d99d7+incompatible, v3.2.0+incompatible, v3.3.0+incompatible, v3.6.0+incompatible+1 more | no fix listed | 16 |
- OSV records
- GHSA-j88v-2chj-qfwx
- Also known as
- GO-2026-5004
Charts affected
308 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| truefoundry-monitoringtruefoundryVerified publisher | 0.1.6 | 1 of 8See more | 4,526 |
| twitter-apptwitter-helm | 0.1.12 | 1 of 8See more | 6,132 |
| twenty-crmvictorlane | 0.0.1 | 1 of 3See more | 13,459 |
| gateway-control-planewallarmVerified publisher | 0.2.0 | 2 of 2See more | 1,455 |
| argo-eventswenerme | 2.4.27 | 1 of 1See more | 969 |
| wexa-studiowexa-studio | 1.2.0 | 3 of 15See more | 14,983 |
| opentelemetry-collectorwikimedia | 0.62.7 | 1 of 1See more | 2,022 |
| ygdrassil-monitoringygdrassilVerified publisher | 0.4.0 | 1 of 10See more | 9,381 |
Container images carrying it
324 by charts deploying them
A fixed version is listed for 1 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | fbeaef7a8566 | github.com/ github.com/ | no fix listed 5.9.2 | 6 |
| caddy/ | 18d1366fc0e9 | github.com/ | no fix listed | 3 |
| ethpandaops/ | d8514b9f4c59 | github.com/ | 5.9.2 | 3 |
| grafana/ | a0f881232a6f | github.com/ | 5.9.2 | 3 |
| migrate/ | cc4ad8e19d66 | github.com/ github.com/ | no fix listed 5.9.2 | 3 |
| oryd/ | 2c93beb5e5f2 | github.com/ | no fix listed | 3 |
| ghcr.io/ | a27779ed1085 | github.com/ | 5.9.2 | 3 |
| ghcr.io/ | 66664ba563e7 | github.com/ | 5.9.2 | 3 |
| ghcr.io/ | 5a878e4e4f03 | github.com/ | no fix listed | 3 |
| ghcr.io/ | 28c5ff40963f | github.com/ | no fix listed | 3 |
| quay.io/ | 75fb847ac045 | github.com/ | no fix listed | 3 |
| quay.io/ | d30a7c640c63 | github.com/ | 5.9.2 | 3 |
| aquasec/ | ea3e33bc3c4e | github.com/ | 5.9.2 | 2 |
| crate/ | b8d89fa5d19b | github.com/ | no fix listed | 2 |
| gotify/ | be44495e4609 | github.com/ | 5.9.2 | 2 |
| grafana/ | 7790f6f7fbd8 | github.com/ | no fix listed | 2 |
| grafana/ | f94b1c82957a | github.com/ | no fix listed | 2 |
| grafana/ | 2175aaa91c96 | github.com/ | 5.9.2 | 2 |
| grafana/ | 9e1e77ade304 | github.com/ | 5.9.2 | 2 |
| grafana/ | d8ea37798ccc | github.com/ | 5.9.2 | 2 |
| grafana/ | e932bd6ed0e0 | github.com/ | 5.9.2 | 2 |
| hashicorp/ | 4db614d40d0e | github.com/ | no fix listed | 2 |
| hashicorp/ | 6b4e5dadf082 | github.com/ github.com/ | no fix listed no fix listed | 2 |
| hashicorp/ | 8de4d5f31b38 | github.com/ github.com/ | no fix listed no fix listed | 2 |
| hoppscotch/ | f1da831950b7 | github.com/ | no fix listed | 2 |
| lightninglabs/ | f86bbec4dfb3 | github.com/ github.com/ | no fix listed 5.9.2 | 2 |
| oryd/ | d06fc5845f63 | github.com/ | no fix listed | 2 |
| oryd/ | fe2428f103a6 | github.com/ | 5.9.2 | 2 |
| oryd/ | e8cb9b79a89c | github.com/ | no fix listed | 2 |
| otel/ | 7ef2a2ff46b9 | github.com/ | no fix listed | 2 |
| rancher/ | 12889bbcd1e8 | github.com/ | 5.9.2 | 2 |
| rookout/ | 4451a6f6b8ec | github.com/ | no fix listed | 2 |
| rookout/ | 51c0fce64467 | github.com/ | no fix listed | 2 |
| timescale/ | 6343bdc87ca1 | github.com/ | 5.9.2 | 2 |
| zhenghaoz/ | 033046b432ec | github.com/ | no fix listed | 2 |
| zhenghaoz/ | 39c565685b01 | github.com/ | no fix listed | 2 |
| zhenghaoz/ | f7739f64c9b0 | github.com/ | no fix listed | 2 |
| ghcr.io/ | b5210df46c05 | github.com/ | 5.9.2 | 2 |
| ghcr.io/ | e2abb798f29f | github.com/ | 5.9.2 | 2 |
| ghcr.io/ | 96f42450c5b1 | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | d47f43484055 | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | 8f9c32b866b0 | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | 364b3ff0fcb7 | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | 2d28f9e3eab4 | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | 301216788e93 | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | fe9de719f91e | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | c057dcdd9ef3 | github.com/ | 5.9.2 | 2 |
| public.ecr.aws/ | 628a14449241 | github.com/ | 5.9.2 | 2 |
| quay.io/ | fa07b2c9ece6 | github.com/ | 5.9.2 | 2 |
| quay.io/ | b736b345437d | github.com/ | no fix listed | 2 |