GitHub Advisoryadvisory · Go

GHSA-6xp3-p59p-q4fj go-pg SQL injection vulnerability via the component /types/append_value.go

MEDIUM Published 2025-06-12 Modified 2025-12-20 Official page ↗
Aliases
CVE-2024-44905
Ecosystem
Go
Packages
github.com/go-pg/pg/v10, github.com/go-pg/pg/v9, github.com/go-pg/pg
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
Reviewed
2025-06-17

Affected packages

• Go github.com/go-pg/pg/v10: < 10.15.0 → fixed in 10.15.0 • Go github.com/go-pg/pg/v9: <= 9.2.1 (no fix yet) • Go github.com/go-pg/pg: <= 8.0.7 (no fix yet)

Description

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

Related

Alias · CVE (1)

  • CVE-2024-44905 go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References