Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M

CVE-2026-59894sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Medium 6.2

In plain English

A medium-severity code injection in sqlparse from andialbrecht. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.2Medium

Exploit odds (30 days)0.1%top 97.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	sqlparse	no fix listed	DEBIAN-CVE-2026-59894
Debian:13	sqlparse	no fix listed	DEBIAN-CVE-2026-59894
Debian:14	sqlparse	no fix listed	DEBIAN-CVE-2026-59894
PyPI	sqlparse	0.6.0	GHSA-3496-9g83-7v6x
PyPI	sqlparse	0.6.0	PYSEC-2026-3696
Ubuntu:22.04:LTS	sqlparse	no fix listed	UBUNTU-CVE-2026-59894
Ubuntu:24.04:LTS	sqlparse	no fix listed	UBUNTU-CVE-2026-59894
Ubuntu:26.04:LTS	sqlparse	no fix listed	UBUNTU-CVE-2026-59894
Ubuntu:26.10	sqlparse	no fix listed	UBUNTU-CVE-2026-59894

Affected products (as reported)

Vendor	Product	Versions
andialbrecht	sqlparse	< 0.6.0

Weakness: CWE-94 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

References

https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x x_refsource_CONFIRM