Alpine: multiple perl-sql-abstract packages: security update to 2.000003-r0

critical Tenable Cloud Security Plugin ID 478644

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values
of a nested statement in an identifier position. A nested statement such as { -select => ... } in a
position where plain scalars are identifiers treats its own plain scalars as identifiers too. These
positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as)
and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go
into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE
condition are not affected. An application that passes untrusted input as a where value of such a nested
statement, expecting it to be bound, allows SQL injection. (CVE-2026-121007)

- SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text
and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and
breaks lines with br elements, so its output is meant to go into a page as is. The format method does not
HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders
SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who
controls a bind value or part of the SQL text to embed JavaScript in the page. (CVE-2026-121008)

- SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for
function names given with -func. injection_guard is documented to apply to every function name, but only
the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name
into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name
passed with -func allows SQL injection. (CVE-2026-121009)

- SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert
and update. With the array_datatypes option off, which is the default, insert(), update() and values()
treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the
rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value.
An application that passes request data as column values to insert or update with the default options
allows SQL injection. Releases before 2.000003 also treat an arrayref in generate() as literal SQL,
including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.
(CVE-2026-121265)

Solution

Update the perl-sql-abstract library and its related packages to version 2.000003-r0 or later.

Plugin Details

Severity: Critical

ID: 478644

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 11/7/2026

Updated: 11/7/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.53

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-121265

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 11/4/2026

Reference Information

CVE: CVE-2026-121007, CVE-2026-121008, CVE-2026-121009, CVE-2026-121265

Detections

Analytics