---
id: "CVE-2026-121007"
kind: "vulnerability"
aliases: ["CVE-2026-121007"]
title: "SQL::Abstract: nested statement values injected into SQL text, enabling SQL injection"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dbi", "package", "perl", "sql-abstract"]
not_affected_if: ["no-untrusted-input", "quote-char-set", "where-clause-subselects-only"]
published_at: "2026-11-04T15:17:41+00:00"
first_seen_at: "2026-11-04T15:27:30+00:00"
updated_at: "2026-11-04T15:28:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121007", "first_seen_at": "2026-11-04T15:27:30+00:00"}]
---

# SQL::Abstract: nested statement values injected into SQL text, enabling SQL injection

SQL::Abstract, a Perl library that builds SQL queries, puts the where, having, set and values data of a nested statement into the SQL text instead of binding it when the statement sits in a select list, ORDER BY, GROUP BY, RETURNING, FROM or JOIN position. An application that passes untrusted input into those values can let an attacker run arbitrary SQL against its database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on `SQL::Abstract` (for example with `cpanm --info SQL::Abstract` or the `cpanfile`/`Makefile.PL` lockfile) and note the installed version.
- Search the codebase for nested statements such as `{ -select => ... }` used inside select lists, ORDER BY, GROUP BY, RETURNING, FROM or JOIN, where the inner where, having, set or values come from user input.
- Check whether `quote_char` is set on the affected query builder.

## Fix

- `SQL::Abstract` `2.000001_04` (affected range: `1.90_01` before `2.000001_04`)

## Timeline

- 2026-11-04T15:27:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121007

## Documents

- [fix] Patch: github.com https://github.com/dbsrgits/sql-abstract/commit/79fc34e874b4edb441154eccddb04c57d5c1c90e.patch

## From the sources

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position.

A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected.

An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_