# CVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile.

The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.

An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.

## Remediation

- fix: Upgrade to SQL-Abstract 2.000001_04 or later. (source: CNA: CPANSec)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: CPANSec) — https://github.com/dbsrgits/sql-abstract/commit/85a75fcde3e09da5181dee07a4eccba76ad94305.patch

## Affected products and versions

-  /  (SQL-Abstract): ≥ 0; < 2.000001_04 (affected, custom). Source: CNA: CPANSec

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/dbsrgits/sql-abstract/commit/85a75fcde3e09da5181dee07a4eccba76ad94305.patch (CNA: CPANSec; patch)

- https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes (CNA: CPANSec; release-notes)

## Provenance

- CNA: CPANSec: https://www.cve.org/CVERecord?id=CVE-2026-121008; retrieved 2026-11-04; source updated 2026-11-04

Revision: c92ed8b19739efc94b36e74027339bca11f459a821371c6b26b790765ce0675f

Canonical: https://y2.dev/cve/CVE-2026-121008

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.