SQL Injection Vulnerability in SQL::Abstract for Perl
CVE-2026-121009

Currently unrated

Key Information:

Status
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121009?

SQL::Abstract for Perl contains a SQL injection vulnerability where the injection_guard check is bypassed for function names specified using the -func option. This oversight allows untrusted function names to be executed unchecked, leading to possible remote code execution or data exposure. Applications relying on the injection_guard for sanitizing input may be compromised, highlighting the need for immediate patches and a thorough review of input validation mechanisms. Update to version 2.000001_04 or later to mitigate this risk.

References

https://github.com/dbsrgits/sql-abstract/commit/b6e7d991a...
patch
https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.