SQL::Abstract before 2.000003 allows SQL injection via arrayref (CVE-2026-121265)
Passing an arrayref column value in insert and update statements enables SQL injection in SQL::Abstract before 2.000003.
15
CVE-2026-121265
SQL Injection in SQL::Abstract before 2.000003
- CVSS 3.1
- 9.8 critical
- EPSS
- <1%p25
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SQL::Abstract versions before 2.000003 allow SQL injection via arrayref column values in insert, update and generate methods. This occurs when the default array_datatypes option is off and request data decoded as arrays (e.g. JSON or form fields) is passed directly as column values. An attacker can trigger this through web applications and gain arbitrary SQL execution. Affected are Perl applications using vulnerable versions of the module.
What to do: Upgrade to SQL::Abstract 2.000003 or later.
| Product | Affected |
|---|---|
| CPAN SQL::Abstract | before 2.000003 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value. An application that passes request data as column values to insert or update with the default options allows SQL injection. Releases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.
- Weakness
- CWE-89
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H