CVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile
SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile.
The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.
An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQL::Abstract::Treeto a version that resolves this vulnerability.Fixed in 2.000001_04
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using SQL::Abstract::Tree before 2.000001_04 are exposed only when they render output from its html profile into a web page, such as a debug panel or query log. Applications that do not place that formatted output in HTML are not described as affected.
What must an attacker control to exploit it?
An attacker must be able to control a bind value or some portion of the SQL text that is formatted with the html profile and rendered in a page. Those values are not HTML-escaped, allowing injected page content to include JavaScript.
Are default deployments affected?
The issue depends on use of the html profile and rendering its output in a page; the provided information does not indicate that this occurs by default. The html profile is specifically intended for output that is inserted into a page as-is.
What can be done before upgrading?
Avoid rendering html-profile output containing untrusted SQL text or bind values in web pages. If such output must be displayed, ensure the SQL text and bind values are HTML-escaped before they reach the page.