{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"SQL-Abstract","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"2.000001_04","status":"affected","version":"1.90_01","versionType":"custom"}]}],"cveId":"CVE-2026-121009","cwes":["CWE-89"],"description":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793802995082,"publishedAt":1793802995082,"references":[{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to SQL-Abstract 2.000001_04 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch"}],"revision":"2547bb25fbc395b007208329a3b9dd860f5c00942a1c6b2ab55bad5855537485","sources":[{"modifiedAt":1793802995082,"name":"CNA: CPANSec","retrievedAt":1793805013051,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121009"}],"ssvc":null,"status":"published","title":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func","updatedAt":1793805013051}