CVE-2026-121007 · Package
NO FIX YET · SEE WHAT TO DO
SQL::Abstract, a Perl library that builds SQL queries, puts the where, having, set and values data of a nested statement into the SQL text instead of binding it when the statement sits in a select list, ORDER BY, GROUP BY, RETURNING, FROM or JOIN position. An application that passes untrusted input into those values can let an attacker run arbitrary SQL against its database.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications written in Perl that use SQL::Abstract to build queries and pass untrusted input as the where, having, set or values of a nested statement placed in an identifier position such as the select list, ORDER BY, GROUP BY, RETURNING, or with ExtraClauses FROM and JOIN. Subselects in a WHERE condition are not affected, and code that never feeds user input into those nested values can skip it.
Not affected if no-untrusted-input, quote-char-set, where-clause-subselects-only
Who cares dbi, perl, sql-abstract
SQL::Abstract (for example with cpanm --info SQL::Abstract or the cpanfile/Makefile.PL lockfile) and note the installed version.{ -select => ... } used inside select lists, ORDER BY, GROUP BY, RETURNING, FROM or JOIN, where the inner where, having, set or values come from user input.quote_char is set on the affected query builder.SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position.
A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected.
An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.
SQL::Abstract 2.000001_04 (affected range: 1.90_01 before 2.000001_04)This page as .md · .json · in your agent: get_signal("CVE-2026-121007")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.