CVE-2026-59894
Received Received - Intake

Code Injection in sqlparse via Unescaped Backslashes

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-59894
EUVD
EUVD-2026-60308

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
andialbrecht sqlparse to 0.6.0 (exc)
andialbrecht sqlparse 0.6.0
sqlparse sqlparse to 0.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the sqlparse library versions 0.5.5 and earlier. It allows code injection in Python and PHP output modes due to improper escaping of backslashes before quotes. Crafted SQL can terminate strings and inject attacker-controlled code into generated snippets. If downstream systems execute or import these snippets, the injected code runs in their environment.

Detection Guidance

Check if your system uses sqlparse versions 0.5.5 or earlier. Run: pip show sqlparse. If installed, verify the version. Also inspect code using sqlparse.format with output_format='python' or 'php' for improper backslash handling.

Impact Analysis

If you use sqlparse to generate Python or PHP code from SQL and downstream systems execute or import this code, attackers could inject malicious code. This could lead to unauthorized access, data breaches, or system compromise depending on the downstream system's privileges.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized code execution, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade sqlparse to version 0.6.0 or later. Update dependencies in your project. Review code using affected output formats to ensure proper escaping. Remove or restrict execution of generated snippets if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart