Log in Start free

Vulnerability · Published Nov 4, 2026 · Assigned by CPANSec

CVE-2026-121009SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func

Unrated

In plain English

A SQL injection in SQL-Abstract. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 92.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libsql-abstract-perlno fix listedDEBIAN-CVE-2026-121009
Debian:13libsql-abstract-perlno fix listedDEBIAN-CVE-2026-121009
Debian:14libsql-abstract-perlno fix listedDEBIAN-CVE-2026-121009
Ubuntu:22.04:LTSlibsql-abstract-perlno fix listedUBUNTU-CVE-2026-121009
Ubuntu:24.04:LTSlibsql-abstract-perlno fix listedUBUNTU-CVE-2026-121009
Ubuntu:26.04:LTSlibsql-abstract-perlno fix listedUBUNTU-CVE-2026-121009
Ubuntu:26.10libsql-abstract-perlno fix listedUBUNTU-CVE-2026-121009

Affected products (as reported)

VendorProductVersions
SQL-Abstract 1.90_01 – before 2.000001_04

Weakness: CWE-89

References