Log in Start free

Vulnerability · Published Nov 4, 2026 · Assigned by CPANSec

CVE-2026-121008SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile

Unrated

In plain English

A cross-site scripting in SQL-Abstract. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 93.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libsql-abstract-perlno fix listedDEBIAN-CVE-2026-121008
Debian:13libsql-abstract-perlno fix listedDEBIAN-CVE-2026-121008
Debian:14libsql-abstract-perlno fix listedDEBIAN-CVE-2026-121008
Ubuntu:22.04:LTSlibsql-abstract-perlno fix listedUBUNTU-CVE-2026-121008
Ubuntu:24.04:LTSlibsql-abstract-perlno fix listedUBUNTU-CVE-2026-121008
Ubuntu:26.04:LTSlibsql-abstract-perlno fix listedUBUNTU-CVE-2026-121008
Ubuntu:26.10libsql-abstract-perlno fix listedUBUNTU-CVE-2026-121008

Affected products (as reported)

VendorProductVersions
SQL-Abstract 0 – before 2.000001_04

Weakness: CWE-79

References