{"id":"CVE-2026-121008","kind":"vulnerability","aliases":["CVE-2026-121008"],"related":[],"title":"Perl SQL::Abstract::Tree: html profile lets bind values inject scripts","description":"SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile.\n\nThe html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.\n\nAn application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.","summary":"SQL::Abstract::Tree's html profile does not HTML-escape SQL text or bind values, so markup passes through unchanged. An application that shows formatted SQL in a debug panel or query log can let an attacker run JavaScript in a user's browser if the attacker controls a bind value or part of the SQL.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","sql-abstract-tree","web-apps"],"not_affected_if":["default-config","no-browser-rendering","no-html-profile"],"how_to_check":"- Check whether the project depends on `SQL::Abstract::Tree` (for example, `cpanm --info SQL::Abstract::Tree` or the `cpanfile`/`Makefile.PL` entry).\n- Check the installed version with `perl -MSQL::Abstract::Tree -e 'print $SQL::Abstract::Tree::VERSION'`.\n- Look for code that calls the html profile of SQL::Abstract::Tree and renders the output into a web page.","fix":"- `SQL::Abstract::Tree` versions before `2.000001_04`\n- Source link for the patch: github.com (the fix page the sources reference)","status":"open","published_at":"2026-11-04T15:17:41+00:00","first_seen_at":"2026-11-04T15:27:30+00:00","triaged_at":"2026-11-04T15:28:37+00:00","updated_at":"2026-11-04T15:28:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T15:28:37Z","model":"claude-haiku-5-5","output":{"fix":"- `SQL::Abstract::Tree` versions before `2.000001_04`\n- Source link for the patch: github.com (the fix page the sources reference)","reach":"internet","title":"Perl SQL::Abstract::Tree: html profile lets bind values inject scripts","impact":"medium","summary":"SQL::Abstract::Tree's html profile does not HTML-escape SQL text or bind values, so markup passes through unchanged. An application that shows formatted SQL in a debug panel or query log can let an attacker run JavaScript in a user's browser if the attacker controls a bind value or part of the SQL.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","sql-abstract-tree","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker runs JavaScript in a viewer's browser session","analyst_note":"","how_to_check":"- Check whether the project depends on `SQL::Abstract::Tree` (for example, `cpanm --info SQL::Abstract::Tree` or the `cpanfile`/`Makefile.PL` entry).\n- Check the installed version with `perl -MSQL::Abstract::Tree -e 'print $SQL::Abstract::Tree::VERSION'`.\n- Look for code that calls the html profile of SQL::Abstract::Tree and renders the output into a web page.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","no-html-profile","no-browser-rendering"],"who_is_affected":"Applications that use the html profile of SQL::Abstract::Tree and insert its output directly into a web page, such as debug panels or query logs, are exposed when user-controlled values reach the SQL. Code that only uses the default text output, or that never shows formatted SQL in a browser, is not affected by this description.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4232,"output_tokens":678,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121008':14A,17A '-2026':13A,16A '04':90C '2.000001':89C 'abstract':3A,22B,28B,85C 'allow':93C,177C 'app':26B 'applic':49B,159C 'around':155C 'attack':64B,74B,179C 'bind':8A,41B,77B,103C,150C,183C 'br':123C 'break':120C 'browser':71B 'control':75B,181C 'cross':95C 'cross-sit':94C 'cve':12A,15A 'debug':56B,172C 'element':118C,124C 'emb':192C 'escap':37B,144C 'fill':153C 'format':52B,138C,163C 'go':131C 'html':5A,31B,36B,107C,110C,143C,166C 'html-escap':35B,142C 'inject':10A 'javascript':66B,193C 'keyword':113C 'let':7A,62B 'line':121C 'log':60B,176C 'markup':44B,157C 'meant':129C 'method':139C 'output':127C 'packag':18B 'page':134C,196C 'panel':57B,173C 'part':80B,186C 'pass':45B 'perl':1A,19B,92C 'placehold':115C 'profil':6A,32B,108C,111C,167C 'queri':59B,175C 'render':161C 'run':65B 'script':11A,97C 'show':51B 'site':96C 'span':117C 'sql':2A,21B,27B,38B,53B,83B,84C,100C,146C,162C,189C 'sql-abstract-tre':20B 'text':39B,101C,147C,190C 'tree':4A,23B,29B,86C 'unchang':47B 'unescap':99C 'user':69B 'valu':9A,42B,78B,104C,151C,184C 'version':87C 'via':98C 'web':25B 'web-app':24B 'wrap':112C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the html profile of SQL::Abstract::Tree and insert its output directly into a web page, such as debug panels or query logs, are exposed when user-controlled values reach the SQL. Code that only uses the default text output, or that never shows formatted SQL in a browser, is not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","perl","sqlabstracttree","webapps"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121008","severity":null,"published_at":"2026-11-04T15:17:41+00:00","modified_at":"2026-11-04T15:17:41+00:00","first_seen_at":"2026-11-04T15:27:30+00:00","fetched_at":"2026-11-04T15:27:30+00:00","note":null}],"documents":[{"id":67831,"url":"https://github.com/dbsrgits/sql-abstract/commit/85a75fcde3e09da5181dee07a4eccba76ad94305.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}