SQL::Abstract::Tree versions before 2.000001_04 for Perl contain a cross-site scripting (XSS) vulnerability in the html profile output. The vulnerability arises because the format method does not HTML-escape SQL text or bind values, allowing an attacker controlling these inputs to inject JavaScript into pages that render this output, such as debug panels or query logs.