CVE-2026-121007— SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position

Quick assessment

Affected

CVE-2026-121007

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 SQL::Abstract 模块在 1.90_01 至 2.000001_04（不含）版本中存在 SQL 注入漏洞。当嵌套语句（例如）出现在原本应使用普通标量作为标识符的位置时，该嵌套语句内部使用的普通标量也会被当作标识符处理。这些位置包括：SELECT 列表、ORDER BY、GROUP BY、RETURNING 子句，以及在使用 ExtraClauses 插件时的 FROM (-as) 和 JOIN (to) 子句。在此类情况下，嵌套语句的 WHERE、HAVING 和 SET 子句中的值，以

AI Predicted 8.6 Difficulty: Moderate Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`1.90_01< 2.000001_04`	affected

Updated Nov 04, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position

Source: CVE Program / CVE List V5

Vulnerability Description

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected. An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	1.90_01 ~ 2.000001_04	-

II. Public POCs for CVE-2026-121007

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121007

请登录查看更多情报信息。

Other References for CVE-2026-121007 (2)

https://www.cve.org/CVERecord?id=CVE-2026-121007

IV. Related Vulnerabilities

Same weakness: CWE-89