PT-2026-139441
CVE-2026-121265
·
Published
2026-11-06
·
Updated
2026-11-07
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
SQL::Abstract versions prior to 2.000003
Description
SQL injection is possible when the
array datatypes option is disabled, which is the default setting. In this state, the insert(), update(), and values() functions treat an arrayref column value as literal SQL, where the first element is inserted into the SQL text without escaping and subsequent elements are used as bind values. This occurs when an application passes request data, such as a JSON array or a repeated form field decoded as an arrayref, as column values. Additionally, the generate() function treats an arrayref as literal SQL, including through AUTOLOAD when allow autoload is enabled, regardless of the array datatypes setting.Recommendations
Update to version 2.000003 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾