Code Injection in Sqlparse - CVE-2026-59894
Published: August 13, 2026
Vulnerability identifier: #VU142412
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59894
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of generation of code in the Python and PHP output filters when generating source-code snippets from caller-supplied SQL. A remote attacker can supply crafted SQL containing backslashes and quotes to execute arbitrary code.
Formatting alone does not execute the payload; exploitation requires a downstream workflow to execute or import the generated Python or PHP snippet. User interaction is required to trigger execution of the generated source.
Affected software
Sqlparse
How to mitigate CVE-2026-59894
Install security update from vendor's website.
Sqlparse - update to 0.6.0