DEBIAN-CVE-2026-121009
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-121009
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-121009.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-121009
- Upstream
- Published
- 2026-11-04T15:17:42Z
- Modified
- 2026-11-05T05:00:16Z
- Summary
- [none]
- Details
-
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.
- References
Affected packages
Debian:12 / libsql-abstract-perl
Package
- Name
- libsql-abstract-perl
- Purl
- pkg:deb/debian/libsql-abstract-perl?arch=source&distro=bookworm
Debian:13 / libsql-abstract-perl
Package
- Name
- libsql-abstract-perl
- Purl
- pkg:deb/debian/libsql-abstract-perl?arch=source&distro=trixie
Debian:14 / libsql-abstract-perl
Package
- Name
- libsql-abstract-perl
- Purl
- pkg:deb/debian/libsql-abstract-perl?arch=source&distro=forky