CVE-2026-59894

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0

Description The sqlparse/filters/output.py module fails to escape existing backslashes before quotes when using output format='python' or output format='php' in the sqlparse.format() function and the corresponding sqlformat -l modes. This allows crafted SQL to neutralize the quote escaping mechanism, terminate the intended language string, and inject Python or PHP code into the generated snippet. Code execution occurs if a downstream consumer executes or imports the generated source. The issue is specifically tied to the Python output filter, which uses single-quoted strings, and the PHP output filter, which uses double-quoted strings.

Recommendations Update sqlparse to version 0.6.0. As a temporary workaround, avoid using the output format='python' and output format='php' parameters in the sqlparse.format() function and the sqlformat -l options.