SQL::Abstract: SQL injection vulnerability (CVE-2026-121265)
SQL::Abstract versions before 2.000003 contain an SQL injection vulnerability arising from improper handling of arrayref column values during insert and update operations.
CVE search metadata
CVE search record: CVE-2026-121265. KEV: no. Product: SQL::Abstract (< 2.000003). Brief: SQL::Abstract: SQL injection vulnerability (CVE-2026-121265). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sql-abstract-injection/
Triage facts
Revision 1- Applicability
- SQL::Abstract (< 2.000003)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 9, 01:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
SQL::Abstract versions prior to 2.000003 contain a vulnerability that allows for SQL injection. The issue occurs when the library processes arrayref column values within insert and update statements. If an application using this library passes unsanitized or untrusted user input into these functions, an attacker can manipulate the generated SQL queries, potentially leading to unauthorized data access or modification.
Impact
The vulnerability allows for potential SQL injection, which could enable attackers to execute arbitrary SQL commands against the database backend, depending on the application implementation and the privileges of the database user.
Recommendation
- Upgrade the SQL::Abstract package to version 2.000003 or later immediately.
- Audit applications that utilize SQL::Abstract to identify where untrusted input is passed to insert or update methods.
- Review database query logs for unusual query syntax or unauthorized data access attempts associated with Perl-based applications.
Immediate actions
Upgrade SQL::Abstract to 2.000003 or later
Threat Hunt
Identify applications utilizing outdated versions of SQL::Abstract
Data: Application dependency manifests (e.g., cpanfile, Makefile.PL)
Mitigations
Upgrade SQL::Abstract to 2.000003 or later
CVE-2026-121265