CVE-2024-44905: go-pg SQL injection vulnerability via the… – CVSS 6.5 · Watchpost

← All vulnerabilities

go-pg SQL injection vulnerability via the component /types/append_value.go

MEDIUM 6.5CVE-2024-44905 · GHSA-6xp3-p59p-q4fj · GO-2025-3764 · Published 12/06/2025 · updated 17/06/2026

In short

CVE-2024-44905 is a MEDIUM (CVSS 6.5) vulnerability affecting github.com/go-pg/pg, github.com/go-pg/pg/v10, github.com/go-pg/pg/v9.
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.8% of all vulnerabilities.
Fix: update to 10.15.0 or later.

Package	Affected versions	Patched versions
github.com/go-pg/pg Go	`≤ 8.0.7all versions`	No fix yet
github.com/go-pg/pg/v10 Go	`< 10.15.0`	`10.15.0`
github.com/go-pg/pg/v9 Go	`≤ 9.2.1all versions`	No fix yet
pg uptrace	`= 10.13.0`	No fix yet

Description

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

NVD description

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

References

nvd.nist.gov/vuln/detail/CVE-2024-44905 · ADVISORY
go-pg/pg commit eff50a4 · WEB
GitHub Advisory GHSA-6xp3-p59p-q4fj · ADVISORY
go-pg/pg · PACKAGE
go-pg/pg · WEB
go-pg/pg release v10.15.0 · WEB
media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf · WEB
sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw · WEB
sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free