Skip to content
Fencer Intel
critical 9.8

CVE-2026-121265 json

SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update

published 4d ago modified yesterday also EUVD-2026-119134

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update.

With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value.

An application that passes request data as column values to insert or update with the default options allows SQL injection.

Releases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.

Patch / fix

  • cpan SQL-Abstract 2.000003
  • perl-SQL-Abstract openSUSE Tumbleweed 2.000002-1.1

opensuse advisories openSUSE-SU-2026:12469-1

  • perl-sql-abstract Alpine 3.24 2.000003-r0

alpine advisories ALPINE-CVE-2026-121265

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2026-121265 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-121265 updated cvss 9.8

perl-sql-abstract: perl-sql-abstract: SQL injection via unescaped array values in database queries

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
yesterday

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • cpan SQL-Abstract

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.