{"id":"CVE-2026-112307","title":"sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting (CVE-2026-112307)","summary":"A flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input contain…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cvssSource":"vendor","cwe":"CWE-94","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["ansible_automation_platform 2","openshift_ai_rhoai","openshift_container_platform 4","satellite 6","update_infrastructure_4_for_cloud_providers"],"published":"2026-10-19","updated":"2026-10-23","sourceUpdated":"2026-10-23T10:32:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112307.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112307.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-112307"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555663"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112307"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112307"},{"url":"https://github.com/andialbrecht/sqlparse/blob/0.6.0/sqlparse/filters/output.py"},{"url":"https://github.com/andialbrecht/sqlparse/pull/930"},{"url":"https://www.vulncheck.com/advisories/sqlparse-through-0.6.0-php-code-injection-via-output-format-php"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00142,"epssPercentile":0.03522,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-19T16:40:54.543031Z"},"ingestedAt":"2026-10-19T16:32:30.082Z","slug":"CVE-2026-112307","body":"## Overview\n\nA flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input containing embedded expressions, leading to arbitrary code execution when the generated PHP snippet is run.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112307.json)\n\n**sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Discovery 2\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenStack Platform 13 (Queens)\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- --- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to sanitize and escape dollar signs when formatting SQL tokens into PHP double-quoted…","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}