{"id":"CVE-2026-121009","title":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func","summary":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name => ... } shorthand g…","severity":"none","cwe":["CWE-89"],"product":"SQL-Abstract","affected":["SQL-Abstract >= 1.90_01 < 2.000001_04"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:36:35.082Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121009","references":[{"url":"https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch"},{"url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.387Z","slug":"CVE-2026-121009","body":"## Overview\n\nSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.\n\n## Affected\n\n- `SQL-Abstract >= 1.90_01 < 2.000001_04`\n\n## Remediation\n\nUpgrade to SQL-Abstract 2.000001_04 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}