This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-59894 | BDVDB-2026-360547 Detail

andialbrechtsqlparse

Description#

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

Impact#

Per CVSS v4.0: confidentiality impact none, integrity impact none, availability impact none. Attack vector: local.

Weaknesses#

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.