Cyber ·
CVE-2026-121265: SQL injection in SQL::Abstract for Perl before 2.000003
Security advisory on the SQL::Abstract library for Perl: arrayref column values in insert and update operations may allow SQL injection in versions earlier than 2.000003.
On 7 November 2026, the oss-sec feed published identifier CVE-2026-121265 for the SQL-Abstract distribution, a Perl library. According to the text, versions earlier than 2.000003 allow SQL injection when arrayref column values are used in insert and update operations. The advisory was attributed to the CPAN Security Group. The available content was machine-translated from the feed, so confirm technical terms against the original. Why it matters: libraries that build SQL queries sit between received data and the database. Teams using Perl with this dependency should check the installed version and update to 2.000003 or later, as the advisory recommends. Rota Nacional does not fix, audit or replace this library; the fix depends on the software project itself. If your team uses AI to study the advisory or review code snippets, do not paste real queries containing customer data, CPF numbers, e-mails or credentials. Replace such data with fictional examples before sending. To verify, consult the original advisory on the oss-sec feed and the distribution page on MetaCPAN, comparing the affected versions.