{"id":"CVE-2026-121009","aliases":["ALPINE-CVE-2026-121009","DEBIAN-CVE-2026-121009","EUVD-2026-116929","GHSA-c656-phfm-x7g8","UBUNTU-CVE-2026-121009","openSUSE-SU-2026:12469-1"],"status":"published","title":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00193,"percentile":0.09038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-11-04T00:00:00Z","modified":"2026-11-10T12:49:35Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-sql-abstract","fixed_in":["2.000003-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-sql-abstract","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.000003-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.000001-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.000001-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.000001-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.81-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.81-1","1.84-1","1.85-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.86-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.87-1","2.000001-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.000001-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.000001-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsql-abstract-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.000001-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-SQL-Abstract","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.000002-1.1"}]}],"bundled":4}],"references":[{"url":"https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121009","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c656-phfm-x7g8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-121009","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121009.json","tags":["advisory"]},{"url":"https://github.com/dbsrgits/sql-abstract","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-121009","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-121009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121009","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44887029/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-121007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-121008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-121009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-121265","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-121009","title":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","status":"published","published":"2026-11-04T14:36:35.082Z","modified":"2026-11-10T12:49:35.806Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2026-116929","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","status":"published","published":"2026-11-04T14:36:35Z","modified":"2026-11-10T12:49:35Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-10T14:21:09.632261Z"}],"ghsa":[{"id":"GHSA-c656-phfm-x7g8","title":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check...","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","status":"published","published":"2026-11-04T15:32:31Z","modified":"2026-11-10T15:34:15Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T15:55:04.021503Z"}],"nvd":[{"id":"CVE-2026-121009","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","status":"published","published":"2026-11-04T15:17:42Z","modified":"2026-11-12T20:07:11.09Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T16:19:50.192525Z"}],"osv":[{"id":"ALPINE-CVE-2026-121009","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","status":"published","published":"2026-11-04T15:17:42Z","modified":"2026-11-11T09:30:03.868844254Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-11T09:58:22.746706Z"},{"id":"CVE-2026-121009","title":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","status":"published","published":"2026-11-04T14:36:35.082Z","modified":"2026-11-12T02:30:53.881136461Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2026-121009","description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.  injection_guard is documented to apply to every function name, but only the { -name =\u003e ... } shorthand goes through it. The explicit { -func =\u003e [ $name, ... ] } form puts $name into the SQL unchecked.  An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","status":"published","published":"2026-11-04T15:17:42Z","modified":"2026-11-11T10:00:47.468401013Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-11T10:35:16.464644Z"},{"id":"openSUSE-SU-2026:12469-1","title":"perl-SQL-Abstract-2.000002-1.1 on GA media","description":"These are all security issues fixed in the perl-SQL-Abstract-2.000002-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:16.031725329Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"UBUNTU-CVE-2026-121009","description":"[Unknown description]","status":"published","published":"2026-11-04T00:00:00Z","modified":"2026-11-05T11:47:28.90320771Z","updated_at":"2026-11-05T13:30:00.949926Z"}]}}