SUSE-SU-2026:5042-1: Security update for python-sqlparse
This update for python-sqlparse fixes the following issue:
- CVE-2026-112307: arbitrary code execution via unescaped PHP output formatting (bsc#1286096).
Other sources
This update for python-sqlparse fixes the following issue: CVE-2026-112307: arbitrary code execution via unescaped PHP output formatting (bsc#1286096).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/python-sqlparseto a version that resolves this vulnerability.Fixed in 0.2.4-150100.6.17.1 - Upgrade
Upgrade
suse/python2-sqlparseto a version that resolves this vulnerability.Fixed in 0.2.4-150100.6.17.1 - Upgrade
Upgrade
python-sqlparseto a version that resolves this vulnerability.Patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-5042
Event History
Frequently Asked Questions
Which systems should be prioritized for this update?
Systems using the SUSE python-sqlparse or python2-sqlparse packages from SUSE Package Hub 15 15-SP7 should be prioritized, because the issue is rated high severity and can lead to arbitrary code execution.
What is the exploitation mechanism described for this issue?
The issue is described as arbitrary code execution through unescaped PHP output formatting. The provided advisory does not state any additional prerequisites, affected configurations, or mitigations.