ALPINE-CVE-2026-121009
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-121009
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-121009.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ALPINE-CVE-2026-121009
- Upstream
- Published
- 2026-11-04T15:17:42Z
- Modified
- 2026-11-07T15:30:02Z
- Summary
- [none]
- Details
-
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.
injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.
An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.
- References