CVE-2026-112307: sqlparse through 0.6.0 PHP Code Injection via output_format='php'
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply SQL text that is processed with output_format='php'. The generated PHP snippet must then be executed for the injected PHP expression to run.
Which inputs should be treated as dangerous?
SQL containing unescaped dollar signs can be dangerous, particularly ${expr} or {${expr}} sequences. These sequences can be placed into double-quoted strings by OutputPHPFilter and evaluated when the generated code runs.
What can be done if updating is not immediately possible?
Do not use output_format='php' for SQL originating from untrusted sources, and do not execute PHP snippets generated from such input. Reject or safely handle SQL containing the affected dollar-sign expression sequences before it reaches OutputPHPFilter.