Cross-Site Scripting Vulnerability in SQL::Abstract::Tree for Perl
CVE-2026-121008

Currently unrated

Key Information:

Status
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121008?

The SQL::Abstract::Tree library for Perl contains a cross-site scripting vulnerability that arises when unescaped SQL statements are rendered in a web application. The issue occurs due to the improper handling of SQL text and bind values in the HTML profile, which wraps these elements in span and br tags without escaping them. This oversight enables an attacker with control over a bind value or portion of the SQL query to inject malicious JavaScript into the web page. It is crucial for developers using affected versions to apply the latest patches to safeguard against potential XSS attacks.

References

https://github.com/dbsrgits/sql-abstract/commit/85a75fcde...
patch
https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.