The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.
An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to SQL-Abstract 2.000001_04 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page. | |
| Title | SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile | |
| Weaknesses | CWE-79 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-04T14:36:13.201Z
Reserved: 2026-11-03T08:07:58.089Z
Link: CVE-2026-121008
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T15:17:41.873
Modified: 2026-11-04T15:17:41.873
Link: CVE-2026-121008
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-04T15:30:09Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')