SQL::Abstract 1.90_01/2.000001_03/2.000001_04 insert/update/values/generate column sql injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in SQL::Abstract. Affected by this issue is the function insert/update/values/generate. The manipulation of the argument column leads to sql injection. This vulnerability is uniquely identified as CVE-2026-121265. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in SQL::Abstract. This issue affects the function insert/update/values/generate. The manipulation of the argument column with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value. An application that passes request data as column values to insert or update with the default options allows SQL injection. Releases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.

It is possible to read the advisory at metacpan.org. The identification of this vulnerability is CVE-2026-121265 since 11/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

Upgrading to version 2.000003 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• SQL::Abstract

Version

• 1.90_01
• 2.000001_03
• 2.000001_04

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion