CVE-2026-121007: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position
SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position.
A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quotechar is set. Subselects in a WHERE condition are not affected.
An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQL::Abstractto a version that resolves this vulnerability.Fixed in 2.000001_04
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using affected SQL::Abstract versions are exposed only if they pass untrusted input as a where, having, set, or -values row value inside a nested -select statement used in an identifier position. Affected identifier positions include the select list, ORDER BY, GROUP BY, RETURNING, and, with the ExtraClauses plugin, FROM (-as) and JOIN (to).
Are nested subselects used in ordinary WHERE conditions affected?
No. Subselects in a WHERE condition are explicitly not affected by this issue.
What configuration changes the injection behavior?
The affected nested-statement values are placed into SQL text rather than the bind list. They are unescaped unless quote_char is set.
What can be done if upgrading is not immediately possible?
Do not pass untrusted input as where, having, set, or -values row values in nested statements used in the affected identifier positions. Restructure such queries so untrusted values are not handled through those nested statements.