---
id: CVE-2026-112307
title: >-
  sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output
  formatting (CVE-2026-112307)
summary: >-
  A flaw was found in sqlparse. The PHP output formatting filter does not
  properly sanitize dollar-sign sequences when formatting SQL statements into
  PHP code. An attacker can exploit this vulnerability by supplying crafted SQL
  input contain…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L'
cvssSource: vendor
cwe: CWE-94
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
affected:
  - ansible_automation_platform 2
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - satellite 6
  - update_infrastructure_4_for_cloud_providers
published: '2026-10-19'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:32:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112307.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112307.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-112307'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555663'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-112307'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112307'
  - url: >-
      https://github.com/andialbrecht/sqlparse/blob/0.6.0/sqlparse/filters/output.py
  - url: 'https://github.com/andialbrecht/sqlparse/pull/930'
  - url: >-
      https://www.vulncheck.com/advisories/sqlparse-through-0.6.0-php-code-injection-via-output-format-php
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00142
epssPercentile: 0.03522
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-19T16:40:54.543031Z'
ingestedAt: '2026-10-19T16:32:30.082Z'
---

## Overview

A flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input containing embedded expressions, leading to arbitrary code execution when the generated PHP snippet is run.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112307.json)

**sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-23.

Affected:

- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers

No fix planned:

- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers

Not affected:

- Red Hat Ansible Automation Platform 2
- Red Hat Discovery 2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0

## Remediation

Affected

Workarounds / mitigations:

- --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to sanitize and escape dollar signs when formatting SQL tokens into PHP double-quoted…