CVE-2026-121009
- Source
- https://cve.org/CVERecord?id=CVE-2026-121009
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-121009.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-121009
- Downstream
- Related
- Published
- 2026-11-04T14:36:35Z
- Modified
- 2026-11-07T17:27:17Z
- Summary
- SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func
- Details
-
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.
injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.
An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.
- Database specific
{ "cna_assigner": "CPANSec", "cwe_ids": [ "CWE-89" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121009.json" }- References
-
- https://cpan.org/modules
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121009.json
- https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes
- https://nvd.nist.gov/vuln/detail/CVE-2026-121009
- https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch
- https://github.com/dbsrgits/sql-abstract
Affected packages
Git / github.com/dbsrgits/sql-abstract
Affected ranges
- Type
- GIT
- Repo
- https://github.com/dbsrgits/sql-abstract
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.90_01" }, { "fixed": "2.000001_04" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "b6e7d991ac588b937e8943a5b28b6837ff276a51" } ], "source": "REFERENCES_COMMIT" } ] }