{"id":"CVE-2026-121007","kind":"vulnerability","aliases":["CVE-2026-121007"],"related":[],"title":"SQL::Abstract: nested statement values injected into SQL text, enabling SQL injection","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position.\n\nA nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected.\n\nAn application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.","summary":"SQL::Abstract, a Perl library that builds SQL queries, puts the where, having, set and values data of a nested statement into the SQL text instead of binding it when the statement sits in a select list, ORDER BY, GROUP BY, RETURNING, FROM or JOIN position. An application that passes untrusted input into those values can let an attacker run arbitrary SQL against its database.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbi","package","perl","sql-abstract"],"not_affected_if":["no-untrusted-input","quote-char-set","where-clause-subselects-only"],"how_to_check":"- Check whether the project depends on `SQL::Abstract` (for example with `cpanm --info SQL::Abstract` or the `cpanfile`/`Makefile.PL` lockfile) and note the installed version.\n- Search the codebase for nested statements such as `{ -select => ... }` used inside select lists, ORDER BY, GROUP BY, RETURNING, FROM or JOIN, where the inner where, having, set or values come from user input.\n- Check whether `quote_char` is set on the affected query builder.","fix":"- `SQL::Abstract` `2.000001_04` (affected range: `1.90_01` before `2.000001_04`)","status":"open","published_at":"2026-11-04T15:17:41+00:00","first_seen_at":"2026-11-04T15:27:30+00:00","triaged_at":"2026-11-04T15:28:39+00:00","updated_at":"2026-11-04T15:28:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T15:28:39Z","model":"claude-haiku-5-5","output":{"fix":"- `SQL::Abstract` `2.000001_04` (affected range: `1.90_01` before `2.000001_04`)","reach":"internet","title":"SQL::Abstract: nested statement values injected into SQL text, enabling SQL injection","impact":"high","summary":"SQL::Abstract, a Perl library that builds SQL queries, puts the where, having, set and values data of a nested statement into the SQL text instead of binding it when the statement sits in a select list, ORDER BY, GROUP BY, RETURNING, FROM or JOIN position. An application that passes untrusted input into those values can let an attacker run arbitrary SQL against its database.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","sql-abstract","dbi"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker runs arbitrary SQL against the application database","analyst_note":"","how_to_check":"- Check whether the project depends on `SQL::Abstract` (for example with `cpanm --info SQL::Abstract` or the `cpanfile`/`Makefile.PL` lockfile) and note the installed version.\n- Search the codebase for nested statements such as `{ -select => ... }` used inside select lists, ORDER BY, GROUP BY, RETURNING, FROM or JOIN, where the inner where, having, set or values come from user input.\n- Check whether `quote_char` is set on the affected query builder.","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-input","where-clause-subselects-only","quote-char-set"],"who_is_affected":"Applications written in Perl that use SQL::Abstract to build queries and pass untrusted input as the where, having, set or values of a nested statement placed in an identifier position such as the select list, ORDER BY, GROUP BY, RETURNING, or with ExtraClauses FROM and JOIN. Subselects in a WHERE condition are not affected, and code that never feeds user input into those nested values can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.0008,"input_tokens":4303,"output_tokens":740,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121007':15A,18A '-2026':14A,17A '01':95C '04':98C '1.90':94C '2.000001':97C 'abstract':2A,24B,26B,91C 'affect':199C 'allow':101C,220C 'applic':72B,201C 'arbitrari':85B 'attack':83B 'bind':52B,184C 'bound':219C 'build':31B 'char':189C 'claus':169C 'condit':196C 'cve':13A,16A 'data':41B 'databas':89B 'dbi':19B 'enabl':10A 'expect':215C 'extraclaus':152C 'go':176C 'group':64B,146C 'identifi':114C,129C,136C 'inject':6A,12A,103C,222C 'input':76B,205C 'instead':50B,181C 'join':69B,157C 'let':81B 'librari':29B 'list':61B,143C,185C 'nest':3A,44B,110C,117C,213C 'order':62B,144C 'packag':20B 'pass':74B,203C 'perl':21B,28B,100C 'plain':126C,133C 'plugin':153C 'posit':70B,115C,124C,139C 'put':34B 'queri':33B 'quot':188C 'return':66B,148C 'row':172C 'run':84B 'scalar':127C,134C 'select':60B,121C,142C 'set':38B,168C,191C 'sit':57B 'sql':1A,8A,11A,23B,25B,32B,48B,86B,90C,102C,179C,221C 'sql-abstract':22B 'statement':4A,45B,56B,111C,118C,163C,214C 'subselect':192C 'text':9A,49B,180C 'treat':130C 'unescap':186C 'unless':187C 'untrust':75B,204C 'valu':5A,40B,79B,107C,160C,175C,209C 'version':92C 'via':104C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Perl that use SQL::Abstract to build queries and pass untrusted input as the where, having, set or values of a nested statement placed in an identifier position such as the select list, ORDER BY, GROUP BY, RETURNING, or with ExtraClauses FROM and JOIN. Subselects in a WHERE condition are not affected, and code that never feeds user input into those nested values can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dbi","package","perl","sqlabstract","unknown"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121007","severity":null,"published_at":"2026-11-04T15:17:41+00:00","modified_at":"2026-11-04T15:17:41+00:00","first_seen_at":"2026-11-04T15:27:30+00:00","fetched_at":"2026-11-04T15:27:30+00:00","note":null}],"documents":[{"id":67830,"url":"https://github.com/dbsrgits/sql-abstract/commit/79fc34e874b4edb441154eccddb04c57d5c1c90e.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}