{"id":"CVE-2026-112307","kind":"vulnerability","aliases":["CVE-2026-112307"],"related":[],"title":"sqlparse: SQL text injects PHP code through unescaped dollar signs","description":"sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.","summary":"sqlparse through 0.6.0 has an output filter that places unescaped dollar-sign sequences from SQL input into double-quoted PHP strings. An attacker who supplies crafted SQL text can get arbitrary PHP code to run when the generated snippet executes.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","sqlparse"],"not_affected_if":["default-config"],"how_to_check":"- Check whether the installed sqlparse version is `0.6.0` or earlier, for example with `pip show sqlparse`.\n- Check whether the application uses the OutputPHPFilter output path to generate PHP code from SQL.","fix":"- Upgrade sqlparse to a version later than `0.6.0`; the fixed version is unknown from the sources.\n- Until patched, do not pass untrusted SQL text through the PHP output filter.","status":"open","published_at":"2026-10-19T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:01:56+00:00","updated_at":"2026-10-25T03:01:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:01:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade sqlparse to a version later than `0.6.0`; the fixed version is unknown from the sources.\n- Until patched, do not pass untrusted SQL text through the PHP output filter.","reach":"unknown","title":"sqlparse: SQL text injects PHP code through unescaped dollar signs","impact":"high","summary":"sqlparse through 0.6.0 has an output filter that places unescaped dollar-sign sequences from SQL input into double-quoted PHP strings. An attacker who supplies crafted SQL text can get arbitrary PHP code to run when the generated snippet executes.","category":"package","nicknames":[],"who_cares":["python","sqlparse"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary PHP code when the generated snippet executes","analyst_note":"Confirm the affected sqlparse fixed version and whether the PHP filter is used by default; check the NVD entry and the sqlparse project advisory.","how_to_check":"- Check whether the installed sqlparse version is `0.6.0` or earlier, for example with `pip show sqlparse`.\n- Check whether the application uses the OutputPHPFilter output path to generate PHP code from SQL.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Applications that use sqlparse and feed user-supplied SQL into its PHP output filter, so the generated PHP snippet is executed. Projects that only use sqlparse to format or parse SQL with the default output, or that never run generated PHP, are unlikely to be exposed. The sources do not say more.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3347,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112307':13A,16A '-2026':12A,15A '0.6.0':22B,64C 'allow':72C 'arbitrari':52B,102C 'attack':44B,73C,86C 'code':6A,54B,68C,104C 'contain':65C,82C 'craft':47B 'cve':11A,14A 'dollar':9A,31B,84C 'dollar-sign':30B 'doubl':39B,98C 'double-quot':38B,97C 'emb':88C 'execut':61B,101C 'expr':89C,91C 'express':77C 'filter':26B 'generat':59B,107C 'get':51B 'inject':4A,69C,75C 'input':36B 'output':25B 'outputphpfilt':94C 'packag':17B 'php':5A,41B,53B,67C,76C,103C 'place':28B,95C 'python':18B 'quot':40B,99C 'run':56B,109C 'sequenc':33B,92C 'sign':10A,32B,85C 'snippet':60B,108C 'sql':2A,35B,48B,80C 'sqlpars':1A,19B,20B,62C 'string':42B,100C 'suppli':46B,79C 'text':3A,49B,81C 'unescap':8A,29B,83C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Applications that use sqlparse and feed user-supplied SQL into its PHP output filter, so the generated PHP snippet is executed. Projects that only use sqlparse to format or parse SQL with the default output, or that never run generated PHP, are unlikely to be exposed. The sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112307","severity":null,"published_at":"2026-10-19T16:17:06+00:00","modified_at":"2026-10-19T17:17:15+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}