PHP Code Injection Vulnerability in sqlparse Product by Andi Albrecht

CVE-2026-112307

What is CVE-2026-112307?

The sqlparse library up to version 0.6.0 is vulnerable to a PHP code injection flaw that arises when SQL text is crafted with unescaped dollar signs. This issue allows attackers to introduce PHP expressions via sequences such as ${expr} or {${expr}}, which the OutputPHPFilter processes in double-quoted strings. Consequently, this can lead to the execution of arbitrary PHP code once the generated snippet is executed, presenting significant risks for applications utilizing this library.

References