ALPINE-CVE-2026-121008: Alpine/perl-sql-abstract vulnerability

Q: Which deployments are exposed to this issue?

Applications are exposed when they use SQL::Abstract::Tree's html profile and render its formatted SQL output directly in a web page, such as a debug panel or query log. Uses that do not place this output into HTML are not described as affected.

Q: What attacker-controlled input is needed for exploitation?

An attacker needs control over a bind value or part of the SQL text that is passed to the formatter. Because those values are not HTML-escaped, injected markup or JavaScript can be included in the rendered page.

Q: Are default configurations affected?

The issue is specifically associated with the html profile. The provided information does not state that other profiles or default formatter settings are affected.

Q: What can be done if an update cannot be applied immediately?

Do not render html-profile formatted SQL directly into pages when the SQL text or bind values may be attacker-controlled. Avoid exposing affected debug panels or query logs to untrusted users.

Q: How can I determine whether an application is vulnerable?

Check whether it uses a SQL::Abstract::Tree version before 2.000001_04 and calls format with the html profile. Then identify whether the resulting output is inserted into a page as HTML while including untrusted SQL fragments or bind values.

Published Nov 4, 2026

Updated

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile.

The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.

An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.

Affected Software

1 affected componentFixes available

alpine/perl-sql-abstract<2.000003-r0

2.000003-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/perl-sql-abstract to a version that resolves this vulnerability.
Fixed in 2.000003-r0
Upgrade
Upgrade SQL::Abstract::Tree to a version that resolves this vulnerability.
Fixed in 2.000001_04

Event History

Nov 4, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications are exposed when they use SQL::Abstract::Tree's html profile and render its formatted SQL output directly in a web page, such as a debug panel or query log. Uses that do not place this output into HTML are not described as affected.

What attacker-controlled input is needed for exploitation?

An attacker needs control over a bind value or part of the SQL text that is passed to the formatter. Because those values are not HTML-escaped, injected markup or JavaScript can be included in the rendered page.

Are default configurations affected?

The issue is specifically associated with the html profile. The provided information does not state that other profiles or default formatter settings are affected.

What can be done if an update cannot be applied immediately?

Do not render html-profile formatted SQL directly into pages when the SQL text or bind values may be attacker-controlled. Avoid exposing affected debug panels or query logs to untrusted users.

How can I determine whether an application is vulnerable?

Check whether it uses a SQL::Abstract::Tree version before 2.000001_04 and calls format with the html profile. Then identify whether the resulting output is inserted into a page as HTML while including untrusted SQL fragments or bind values.

ALPINE-CVE-2026-121008: Alpine/perl-sql-abstract vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What attacker-controlled input is needed for exploitation?

Are default configurations affected?

What can be done if an update cannot be applied immediately?

How can I determine whether an application is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What attacker-controlled input is needed for exploitation?

Are default configurations affected?

What can be done if an update cannot be applied immediately?

How can I determine whether an application is vulnerable?