SQL Injection Vulnerability in sqlparse Library by Andi Albrecht
CVE-2026-59894

6.2MEDIUM

Key Information:

Vendor

Andialbrecht

Status
Sqlparse
Vendor
CVE Published:
17 August 2026

What is CVE-2026-59894?

The sqlparse library, a non-validating SQL parser for Python, prior to version 0.6.0, contains a vulnerability whereby it fails to properly escape backslashes before quotes in specific output formats. This oversight can allow crafted SQL input to terminate the generated string, leading to potential execution of arbitrary Python or PHP code when the affected output is utilized by downstream applications. The issue has been addressed in version 0.6.0, highlighting the importance of updating to mitigate security risks.

Affected Version(s)

sqlparse < 0.6.0

References

https://github.com/andialbrecht/sqlparse/security/advisor...
x_refsource_CONFIRM

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.