CVE-2026-121009: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func
SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func.
injectionguard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.
An application that relies on injectionguard to reject an untrusted function name passed with -func allows SQL injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQL::Abstractto a version that resolves this vulnerability.Fixed in 2.000001_04
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they use SQL::Abstract from 1.90_01 before 2.000001_04, rely on injection_guard, and pass an untrusted function name through the explicit { -func => [ $name, ... ] } form. Uses of the { -name => ... } shorthand are checked by injection_guard.
What must an attacker control to exploit the vulnerability?
An attacker must be able to influence the function-name value supplied as $name in an explicit -func array. The issue occurs because that value is inserted into generated SQL without the injection_guard check.
How can I determine whether my code is affected?
Review SQL::Abstract call sites for { -func => [ $name, ... ] } and determine whether $name can contain untrusted input. Also verify whether the deployed SQL::Abstract version is at least 2.000001_04.