CVE-2026-13766

Name of the Vulnerable Software and Affected Versions DBIx::QuickORM versions prior to 0.000026

Description An issue exists where SQL identifiers are emitted verbatim into generated queries without proper quoting or escaping. This occurs because the default SQL builder, a SQL::Abstract subclass, fails to set the quote char in its constructor. Consequently, caller-supplied identifiers reach the SQL string raw, while only values are placeholder-bound. An attacker can exploit this by providing crafted input to identifier positions, such as order by values, where-clause column keys, field and returning lists, upsert columns, and join aliases. This can lead to unauthorized data disclosure and tampering, such as making row order depend on a sub-select over columns not originally selected.

Recommendations Update to version 0.000026.