CVE-2026-112307
HighCVSS 7.3Summary
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
Risk Assessment
Arbitrary PHP code execution is possible in the context of an application processing untrusted SQL, potentially leading to server takeover and data leakage. The risk applies to systems using sqlparse to generate PHP code.
Recommendation
Update sqlparse to a version later than 0.6.0 if available, or avoid using OutputPHPFilter on untrusted input. Implement validation and escaping of SQL text before processing.
Other vulnerabilities in sqlparse
See all- CVE-2026-84305Medium
A vulnerability in sqlparse (a SQL parser module for Python) before version 0.6.0 causes excessive CPU consumption when formatting queries with parenthesized tuple lists, potentially leading to request delays and reduced throughput.
- CVE-2026-71491High
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
- CVE-2026-59894Medium
sqlparse before 0.6.0 has a vulnerability in sqlparse/filters/output.py that fails to escape existing backslashes before quotes in output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source.
- CVE-2026-59893High
sqlparse before version 0.6.0 has a performance issue: SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.
- CVE-2026-54284High
sqlparse before version 0.6.0 has a performance issue: TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.
Original NVD description (English source)
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS