We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-59894

CVE-2026-59894

PHP

Severity: —
CVSS: —CVSS
Published: 2026-08-17
Last modified: 2026-08-17
CWE: CWE-94

Description

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

References

https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x

Summary

Description

References