Search: CVE-2026-59894

CVE-2026-59894 is a code injection vulnerability in the Python sqlparse module prior to version 0.6.0. The issue occurs in sqlparse/filters/output.py where backslashes before quotes are not properly escaped when using output_format='python' or 'php'. This allows crafted SQL input to terminate the generated string and inject arbitrary Python or PHP code if the generated source is executed or imported downstream. The vulnerability is fixed in version 0.6.0.