CVE-2026-121007
Received Received - Intake

SQL Injection in SQL::Abstract Perl Module

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: CPANSec

Description
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected. An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121007
EUVD
EUVD-2026-116927

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SQL::Abstract versions before 2.000001_04 for Perl have a flaw where nested SQL statements incorrectly treat scalar values in certain clauses like where, having, set, and values as identifiers instead of bind values. This allows unescaped SQL injection if quote_char is not set, as plain scalars are rendered directly into the SQL text rather than being bound as parameters.

Detection Guidance

To detect this vulnerability, review Perl applications using SQL::Abstract versions before 2.000001_04. Check for nested SQL statements where untrusted input is passed to where, having, set, or values clauses without proper escaping. Look for code patterns like { -select => ..., where => { id => $user_input } } where $user_input is not bound as a parameter.

Impact Analysis

An application using affected SQL::Abstract versions could allow attackers to inject malicious SQL code through untrusted input in nested statements. This could lead to unauthorized data access, modification, or deletion in the database, depending on the application's permissions.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from unauthorized data exposure.

Mitigation Strategies

Immediately upgrade SQL::Abstract to version 2.000001_04 or later. Ensure all nested SQL statements use proper parameter binding for scalar values in where, having, set, or values clauses. Set quote_char in SQL::Abstract to enforce escaping of identifiers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...