CVE-2026-121008 · Package
NO FIX YET · SEE WHAT TO DO
SQL::Abstract::Tree's html profile does not HTML-escape SQL text or bind values, so markup passes through unchanged. An application that shows formatted SQL in a debug panel or query log can let an attacker run JavaScript in a user's browser if the attacker controls a bind value or part of the SQL.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that use the html profile of SQL::Abstract::Tree and insert its output directly into a web page, such as debug panels or query logs, are exposed when user-controlled values reach the SQL. Code that only uses the default text output, or that never shows formatted SQL in a browser, is not affected by this description.
Not affected if default-config, no-browser-rendering, no-html-profile
Who cares perl, sql-abstract-tree, web-apps
SQL::Abstract::Tree (for example, cpanm --info SQL::Abstract::Tree or the cpanfile/Makefile.PL entry).perl -MSQL::Abstract::Tree -e 'print $SQL::Abstract::Tree::VERSION'.SQL::Abstract::Tree versions before SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile.
The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.
An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
2.000001_04This page as .md · .json · in your agent: get_signal("CVE-2026-121008")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.