CVE-2026-121009 · Package
NO FIX YET · SEE WHAT TO DO
SQL::Abstract for Perl skips its injection_guard check when a function name is passed through the -func form. An application that relies on that guard to block untrusted function names can have SQL injected through them.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that build SQL with SQL::Abstract, pass function names through the -func form, and depend on injection_guard to reject untrusted input are exposed. Code that uses only hardcoded function names, or that does not use injection_guard, is less likely to be affected. unknown whether other forms are affected beyond what the description states.
Not affected if hardcoded-function-names, no-injection-guard
Who cares dbi, perl, sql-abstract
perl -MSQL::Abstract -e 'print $SQL::Abstract::VERSION'-func used with values that come from user inputinjection_guard is set in code that builds queries with SQL::Abstract2.000001_04 or later (fixed in versions from 1.90_01 before 2.000001_04 are affected)SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.
injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.
An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.
This page as .md · .json · in your agent: get_signal("CVE-2026-121009")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.