CVE-2026-121009

    Dashboard / Vulnerabilities / CVE-2026-121009

    CVE-2026-121009

    Published: 4 Nov 2026Last Modified: 7 Nov 2026

    Summary: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func

    Details: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

    References: https://cpan.org/modules, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121009.json, https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes, https://nvd.nist.gov/vuln/detail/CVE-2026-121009, https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch, https://github.com/dbsrgits/sql-abstract

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a2827243610982d61fe853699bc6f4641b1c64ff
    Fixed -d01770bf97b963a02acc11bf5834cba881c6e504

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121009 | CVE-DB