CVE-2026-59894: CWE-94: Improper Control of Generation of Code ('Code Injection') in andialbrecht sqlparse
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.
AI Analysis
Technical Summary
The sqlparse module for Python, versions before 0.6.0, contains a CWE-94 improper control of code generation vulnerability. Specifically, in sqlparse/filters/output.py, the code does not escape existing backslashes before quotes when formatting SQL output with output_format='python' or 'php'. This allows an attacker to craft SQL input that can break out of the generated string context and inject arbitrary code in Python or PHP, which may be executed if the generated source code is run or imported. The vulnerability is addressed in version 0.6.0 of sqlparse.
Potential Impact
If exploited, this vulnerability could allow an attacker to execute arbitrary Python or PHP code in the context of the application that processes the generated source code. This could lead to unauthorized code execution, potentially compromising the system or application using sqlparse. The CVSS 4.0 base score is 6.2 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and high scope and impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade sqlparse to version 0.6.0 or later, where this code injection vulnerability has been fixed. No other mitigation is indicated or required according to the available data.
CVE-2026-59894: CWE-94: Improper Control of Generation of Code ('Code Injection') in andialbrecht sqlparse
Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.
CVSS v4.0
Score 6.2medium
Affected software
andialbrecht
sqlparse
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The sqlparse module for Python, versions before 0.6.0, contains a CWE-94 improper control of code generation vulnerability. Specifically, in sqlparse/filters/output.py, the code does not escape existing backslashes before quotes when formatting SQL output with output_format='python' or 'php'. This allows an attacker to craft SQL input that can break out of the generated string context and inject arbitrary code in Python or PHP, which may be executed if the generated source code is run or imported. The vulnerability is addressed in version 0.6.0 of sqlparse.
Potential Impact
If exploited, this vulnerability could allow an attacker to execute arbitrary Python or PHP code in the context of the application that processes the generated source code. This could lead to unauthorized code execution, potentially compromising the system or application using sqlparse. The CVSS 4.0 base score is 6.2 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and high scope and impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade sqlparse to version 0.6.0 or later, where this code injection vulnerability has been fixed. No other mitigation is indicated or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T16:40:07.983Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a834478bf8831d5394445bd
Added to database: 08/17/2026, 17:27:20 UTC
Last enriched: 08/17/2026, 17:43:39 UTC
Last updated: 10/02/2026, 02:46:05 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.