{"id":"CVE-2026-121009","kind":"vulnerability","aliases":["CVE-2026-121009"],"related":[],"title":"Perl SQL::Abstract: function-name guard skipped, allowing SQL injection","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","summary":"SQL::Abstract for Perl skips its injection_guard check when a function name is passed through the -func form. An application that relies on that guard to block untrusted function names can have SQL injected through them.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbi","package","perl","sql-abstract"],"not_affected_if":["hardcoded-function-names","no-injection-guard"],"how_to_check":"- Check the installed SQL::Abstract version with `perl -MSQL::Abstract -e 'print $SQL::Abstract::VERSION'`\n- Search the codebase for `-func` used with values that come from user input\n- Check whether `injection_guard` is set in code that builds queries with SQL::Abstract","fix":"- SQL::Abstract: move to `2.000001_04` or later (fixed in versions from 1.90_01 before 2.000001_04 are affected)","status":"open","published_at":"2026-11-04T15:17:42+00:00","first_seen_at":"2026-11-04T15:27:30+00:00","triaged_at":"2026-11-04T15:28:36+00:00","updated_at":"2026-11-04T15:28:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T15:28:36Z","model":"claude-haiku-5-5","output":{"fix":"- SQL::Abstract: move to `2.000001_04` or later (fixed in versions from 1.90_01 before 2.000001_04 are affected)","reach":"unknown","title":"Perl SQL::Abstract: function-name guard skipped, allowing SQL injection","impact":"high","summary":"SQL::Abstract for Perl skips its injection_guard check when a function name is passed through the -func form. An application that relies on that guard to block untrusted function names can have SQL injected through them.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","sql-abstract","dbi"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker injects SQL through function names, reading or changing database data","analyst_note":"","how_to_check":"- Check the installed SQL::Abstract version with `perl -MSQL::Abstract -e 'print $SQL::Abstract::VERSION'`\n- Search the codebase for `-func` used with values that come from user input\n- Check whether `injection_guard` is set in code that builds queries with SQL::Abstract","plain_action":"","needs_analyst":false,"not_affected_if":["hardcoded-function-names","no-injection-guard"],"who_is_affected":"Applications that build SQL with SQL::Abstract, pass function names through the -func form, and depend on injection_guard to reject untrusted input are exposed. Code that uses only hardcoded function names, or that does not use injection_guard, is less likely to be affected. unknown whether other forms are affected beyond what the description states.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4186,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121009':14A,17A '-2026':13A,16A '01':64C '04':67C '1.90':63C '2.000001':66C 'abstract':3A,23B,25B,60C 'allow':9A,126C 'appli':86C 'applic':44B,111C 'block':51B 'check':32B,74C 'cve':12A,15A 'dbi':18B 'document':84C 'everi':88C 'explicit':100C 'form':42B,103C 'func':41B,80C,101C,125C 'function':5A,35B,53B,76C,89C,121C 'function-nam':4A 'given':78C 'goe':96C 'guard':7A,31B,49B,73C,82C,116C 'inject':11A,30B,58B,72C,81C,115C,128C 'name':6A,36B,54B,77C,90C,94C,102C,105C,122C 'packag':19B 'pass':38B,123C 'perl':1A,20B,27B,69C 'put':104C 'reject':118C 'reli':46B,113C 'shorthand':95C 'skip':8A,28B,70C 'sql':2A,10A,22B,24B,57B,59C,108C,127C 'sql-abstract':21B 'uncheck':109C 'untrust':52B,120C 'version':61C","nicknames":[],"mitigations":[],"who_affected":"Applications that build SQL with SQL::Abstract, pass function names through the -func form, and depend on injection_guard to reject untrusted input are exposed. Code that uses only hardcoded function names, or that does not use injection_guard, is less likely to be affected. unknown whether other forms are affected beyond what the description states.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dbi","package","perl","sqlabstract","unknown"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121009","severity":null,"published_at":"2026-11-04T15:17:42+00:00","modified_at":"2026-11-04T15:17:42+00:00","first_seen_at":"2026-11-04T15:27:30+00:00","fetched_at":"2026-11-04T15:27:30+00:00","note":null}],"documents":[{"id":67834,"url":"https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}