CVE-2026-121009— SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func

Quick assessment

Affected

CVE-2026-121009

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 SQL::Abstract 模块在 1.90_01 至 2.000001_04（不含）版本中，对于通过选项指定的函数名称，会跳过的安全检查。的文档说明其应适用于所有函数名称，但实际上仅对简写形式生效。而显式的形式会将未经检查直接插入到 SQL 语句中。因此，任何依赖来拒绝通过传入的不可信函数名称的应用程序，都可能面临 SQL 注入风险。

AI Predicted 8.2 Difficulty: Easy Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`1.90_01< 2.000001_04`	affected

Updated Nov 04, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func

Source: CVE Program / CVE List V5

Vulnerability Description

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	1.90_01 ~ 2.000001_04	-

II. Public POCs for CVE-2026-121009

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121009

请登录查看更多情报信息。

Other References for CVE-2026-121009 (2)

https://www.cve.org/CVERecord?id=CVE-2026-121009

IV. Related Vulnerabilities

Same weakness: CWE-89