CVE-2026-59894
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
sqlparse before 0.6.0 has a vulnerability in sqlparse/filters/output.py that fails to escape existing backslashes before quotes in output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source.
Risk Assessment
The risk includes remote code execution in the environment that processes the generated code, potentially leading to full application compromise.
Recommendation
It is recommended to upgrade to version 0.6.0 or later, which includes the fix.
Original NVD description (English source)
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.