CVE-2026-112307: Improper Control of Generation of Code ('Code Injection') in andialbrecht sqlparse

CVE-2026-112307 describes a PHP code injection vulnerability in the andialbrecht sqlparse library through version 0.6.0. Attackers can supply SQL text containing unescaped dollar signs that embed ${expr} or {${expr}} sequences. These sequences are processed by OutputPHPFilter and placed inside double-quoted strings, resulting in execution of arbitrary PHP code when the generated snippet executes. This improper control of code generation allows for remote code execution under certain conditions.

Successful exploitation enables an attacker to execute arbitrary PHP code within the context of the application using sqlparse. This can lead to unauthorized actions, data compromise, or system control depending on the environment where sqlparse is used.

No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted SQL text containing dollar signs with sqlparse or apply manual sanitization to prevent injection of PHP expressions.