Threat database

sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.

CVE-2026-71491 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue involves uncontrolled resource consumption due to the group_comments function repeatedly rescanning comment-only SQL statements, leading to quadratic CPU usage during parsing and formatting operations. This vulnerability can cause significant performance degradation when processing certain SQL inputs. The issue is fixed in sqlparse version 0.6.0.

CVE-2026-59893 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue involves inefficient regular expression complexity causing quadratic CPU consumption when parsing certain SQL constructs such as unmatched dollar-quoted literals and multiline comments. This can lead to denial of service through excessive CPU usage. The vulnerability is fixed in sqlparse version 0.6.0.

CVE-2026-59894 is a code injection vulnerability in the Python sqlparse module prior to version 0.6.0. The issue occurs in sqlparse/filters/output.py where backslashes before quotes are not properly escaped when using output_format='python' or 'php'. This allows crafted SQL input to terminate the generated string and inject arbitrary Python or PHP code if the generated source is executed or imported downstream. The vulnerability is fixed in version 0.6.0.

CVE-2026-54284 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue arises from inefficient algorithmic complexity during TokenList construction and string conversion, causing quadratic CPU consumption when using sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This inefficiency is due to repeatedly flattening nested token subtrees. The vulnerability is fixed in sqlparse version 0.6.0.

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.