VYPR
← All advisories
Medium severityNVD Advisory· Published Aug 17, 2026· Updated Sep 18, 2026

CVE-2026-59894

CVE-2026-59894

Description

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
sqlparsePyPI
< 0.6.00.6.0

Affected products

64

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.