CVE-2026-59894: sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sqlparse/filters/output.pyto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59894?
The severity of CVE-2026-59894 is rated at 55, indicating a notable risk level.
How do I fix CVE-2026-59894?
To fix CVE-2026-59894, update the sqlparse module to version 0.6.0 or later.
What systems are affected by CVE-2026-59894?
CVE-2026-59894 affects the sqlparse module used in Python prior to version 0.6.0.
What kind of vulnerability is CVE-2026-59894?
CVE-2026-59894 is classified as a code injection vulnerability.
What components of sqlparse are vulnerable in CVE-2026-59894?
The vulnerability exists in sqlparse/filters/output.py, which fails to properly escape backslashes.