SQL Injection Vulnerability in SQL::Abstract for Perl
CVE-2026-121265
Currently unrated
What is CVE-2026-121265?
The SQL::Abstract for Perl, prior to version 2.000003, contains a vulnerability that allows an attacker to exploit SQL injection through arrayref column values during insert and update operations. With the default configuration disabling the array_datatypes option, these operations can treat an unescaped arrayref value as literal SQL, posing a serious risk if untrusted input is processed. This issue expands to the use of arrayrefs in the generate() method, increasing its exploitability, especially when certain auto-loading features are enabled. Applications that fail to sanitize input before passing data as column values are particularly vulnerable.