---
id: CVE-2026-121009
title: >-
  SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the
  injection_guard check for function names given with -func
summary: >-
  SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the
  injection_guard check for function names given with -func.


  injection_guard is documented to apply to every function name, but only the {
  -name => ... } shorthand g…
severity: none
cwe:
  - CWE-89
product: SQL-Abstract
affected:
  - SQL-Abstract >= 1.90_01 < 2.000001_04
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:36:35.082Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121009'
references:
  - url: >-
      https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch
  - url: 'https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.387Z'
---

## Overview

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.

injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.

An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

## Affected

- `SQL-Abstract >= 1.90_01 < 2.000001_04`

## Remediation

Upgrade to SQL-Abstract 2.000001_04 or later.