Cyber ·
SQL::Abstract for Perl before 2.000001_04: three CVEs for SQL injection and XSS
Three vulnerabilities (CVE-2026-121007, CVE-2026-121008 and CVE-2026-121009) affect versions of SQL::Abstract and SQL::Abstract::Tree for Perl before 2.000001_04. The reports cite SQL injection and XSS.
The advisory was posted to the oss-sec feed on 4 November 2026 and is a machine translation of the original content. According to the available text, three CVEs affect Perl libraries used to build SQL queries. CVE-2026-121007: SQL::Abstract versions from 1.90_01 up to before 2.000001_04 allow SQL injection through the where values of a nested statement in an identifier position. CVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 allow cross-site scripting through unescaped SQL text and bind values in the html profile. CVE-2026-121009: SQL::Abstract versions from 1.90_01 up to before 2.000001_04 bypass a check, but the received text is truncated and does not detail the effect. The indicated fix is version 2.000001_04 or later. To verify, consult the original oss-sec list entry from Q4 2026, message 513, and the official CVE records.
Original source: SQL-Abstract para Perl anterior à versão 2.000001_04: três CVEs