CVE-2026-121009

SQL::Abstract versions from 1.90 01 before 2.000001 04 for Perl skip the injection guard check for function names given with -func.

injection guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.

An application that relies on injection guard to reject an untrusted function name passed with -func allows SQL injection.