---
id: "CVE-2026-121009"
kind: "vulnerability"
aliases: ["CVE-2026-121009"]
title: "Perl SQL::Abstract: function-name guard skipped, allowing SQL injection"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dbi", "package", "perl", "sql-abstract"]
not_affected_if: ["hardcoded-function-names", "no-injection-guard"]
published_at: "2026-11-04T15:17:42+00:00"
first_seen_at: "2026-11-04T15:27:30+00:00"
updated_at: "2026-11-04T15:28:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121009", "first_seen_at": "2026-11-04T15:27:30+00:00"}]
---

# Perl SQL::Abstract: function-name guard skipped, allowing SQL injection

SQL::Abstract for Perl skips its injection_guard check when a function name is passed through the -func form. An application that relies on that guard to block untrusted function names can have SQL injected through them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SQL::Abstract version with `perl -MSQL::Abstract -e 'print $SQL::Abstract::VERSION'`
- Search the codebase for `-func` used with values that come from user input
- Check whether `injection_guard` is set in code that builds queries with SQL::Abstract

## Fix

- SQL::Abstract: move to `2.000001_04` or later (fixed in versions from 1.90_01 before 2.000001_04 are affected)

## Timeline

- 2026-11-04T15:27:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121009

## Documents

- [fix] Patch: github.com https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch

## From the sources

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.

injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.

An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_