PHP Code Injection Vulnerability in sqlparse Package
Summary
DEBIAN-CVE-2026-112307: sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Affects sqlparse versions 0.4.2-1 – 0.5.5-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sqlparse package is a lightweight SQL parser for Python that is widely used in various applications for parsing SQL statements. It provides functionalities to analyze and manipulate SQL queries, making it a valuable tool for developers. However, the package is vulnerable to a PHP code injection issue that can be exploited if SQL text containing unescaped dollar signs is supplied.
Vulnerability Detail
sqlparse through version 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text with unescaped dollar signs. This vulnerability arises from the way OutputPHPFilter processes SQL strings, enabling attackers to embed sequences like ${expr} or {${expr}}. When the generated snippet runs, it executes arbitrary PHP code, potentially compromising the application and its data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using unescaped dollar signs in SQL text supplied to the sqlparse package. Review and sanitize any SQL inputs to prevent the injection of malicious PHP expressions.
Conclusion
The sqlparse package is vulnerable to a PHP code injection issue that can lead to severe security risks if not addressed. It is crucial to update to a patched version and implement input validation to protect your applications from potential exploitation.
See every vulnerability recorded for sqlparse →
FAQ
sqlparse is a Python library that provides a non-validating SQL parser for parsing SQL statements. It is commonly used in applications that require SQL query analysis.
If your application uses sqlparse and processes untrusted SQL input, an attacker could exploit this vulnerability to execute arbitrary PHP code, leading to data breaches or application compromise.
Yes, a patch is available in versions of sqlparse higher than 0.6.0. It is recommended to update to the latest version to mitigate the risk.
If immediate updates are not possible, implement input validation and sanitization to prevent unescaped dollar signs in SQL text as a temporary workaround.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without requiring any installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
