ALPINE-CVE-2026-121009: SQL Injection

Q: Which applications are exposed to this issue?

Applications are exposed if they use SQL::Abstract with the explicit { -func => [ $name, ... ] } form and allow an untrusted value to control the function name. Relying on injection_guard for this validation does not protect that code path.

Published Nov 4, 2026

Updated

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func.

injectionguard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.

An application that relies on injectionguard to reject an untrusted function name passed with -func allows SQL injection.

Affected Software

1 affected componentFixes available

alpine/perl-sql-abstract<2.000003-r0

2.000003-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/perl-sql-abstract to a version that resolves this vulnerability.
Fixed in 2.000003-r0
Upgrade
Upgrade SQL::Abstract to a version that resolves this vulnerability.
Fixed in 2.000001_04

Event History

Nov 4, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications are exposed if they use SQL::Abstract with the explicit { -func => [ $name, ... ] } form and allow an untrusted value to control the function name. Relying on injection_guard for this validation does not protect that code path.

What must an attacker control to exploit the vulnerability?

An attacker needs to be able to supply or influence the function name passed as $name in the -func array form. That value is inserted into the generated SQL without the injection_guard check.

Are all SQL::Abstract function-name syntaxes affected?

No. The documented { -name => ... } shorthand goes through injection_guard. The affected syntax is the explicit { -func => [ $name, ... ] } form.

What can be done before updating?

Do not pass untrusted input as the function name in a -func expression. Restrict function names to application-controlled values or validate them against a strict allowlist before constructing the SQL expression.

ALPINE-CVE-2026-121009: SQL Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit the vulnerability?

Are all SQL::Abstract function-name syntaxes affected?

What can be done before updating?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit the vulnerability?

Are all SQL::Abstract function-name syntaxes affected?

What can be done before updating?