SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value. An application that passes request data as column values to insert or update with the default options allows SQL injection. Releases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values
    of a nested statement in an identifier position. A nested statement such as { -select => ... } in a
    position where plain scalars are identifiers treats its own plain scalars as identifiers too. These
    positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as)
    and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go
    into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE
    condition are not affected. An application that passes untrusted input as a where value of such a nested
    statement, expecting it to be bound, allows SQL injection. (CVE-2026-121007)

  - SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text
    and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and
    breaks lines with br elements, so its output is meant to go into a page as is. The format method does not
    HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders
    SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who
    controls a bind value or part of the SQL text to embed JavaScript in the page. (CVE-2026-121008)

  - SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for
    function names given with -func. injection_guard is documented to apply to every function name, but only
    the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name
    into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name
    passed with -func allows SQL injection. (CVE-2026-121009)

  - SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert
    and update. With the array_datatypes option off, which is the default, insert(), update() and values()
    treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the
    rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value.
    An application that passes request data as column values to insert or update with the default options
    allows SQL injection. Releases before 2.000003 also treat an arrayref in generate() as literal SQL,
    including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.
    (CVE-2026-121265)

ID	Name	Product	Family	Type	Severity
478644	Alpine: multiple perl-sql-abstract packages: security update to 2.000003-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
478644	Alpine: multiple perl-sql-abstract packages: security update to 2.000003-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-121265

critical

Tenable Plugins

critical

critical