Read the docs
TI-2026-85072 Aliases CVE-2026-121008GHSA-fcg4-533h-9xx3

Cross-site scripting in SQL::Abstract::Tree html profile output

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Cross-site scripting
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-79.

Summary

SQL::Abstract::Tree for Perl before 2.000001_04 does not HTML-escape SQL text or bind values in the output of its html profile (CWE-79). An application that renders this output in a debug panel or query log lets an attacker who controls a bind value or part of the SQL text embed JavaScript in the page.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.

Why it matters now

EPSS 0.00174 6th percentileScored 2026-11-07
Fix Fixed SQL-Abstract: 2.000001_04

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—SQL-Abstractbefore 2.000001_042.000001_04Patch availableCNA
  • SQL-Abstract Vendor— Affected before 2.000001_04 Fixed in 2.000001_04 Patch available CNA

Remediation

Upgrade SQL-Abstract to version 2.000001_04, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA SQL-Abstract Fixed in 2.000001_04

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121008
  2. 2026-11-04 Alias added: GHSA-fcg4-533h-9xx3
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat

References

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences