CVE-2026-59894
published 2026-08-17CVE-2026-59894: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in…
PriorityP429medium6.2CVSS 4.0
AVLACLATNPRNUIPVCNVINVANSCHSIHSALEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.13%
2.3th percentile
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.
Affected
204 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| andialbrecht | sqlparse | < 0.6.0 | 0.6.0 |
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-24 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-24 | hub-rhel8 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ansible-dev-tools-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-25 | gateway-rhel8 | — | — |
| ansible-automation-platform-25 | hub-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | aap-cloud-billing-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | metrics-service-rhel9 | — | — |
CVSS provenance
nvdv4.06.2MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sqlparse: sqlparse: Arbitrary code execution via unescaped backslashes in generated snippets
vendor_redhat·2026-08-17·CVSS 6.2
CVE-2026-59894 [MEDIUM] CWE-94 sqlparse: sqlparse: Arbitrary code execution via unescaped backslashes in generated snippets
sqlparse: sqlparse: Arbitrary code execution via unescaped backslashes in generated snippets
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.
A flaw was found in sqlparse, a non-validating SQL parser module for Python. When generating Python or PHP code snippets, the `sqlparse.format` function fails to properly escape backslashes before quotes in SQL strings. This vulnerability allows a loca
VulDB
andialbrecht sqlparse up to 0.5.x Output output.py sqlparse.format output_format code injection (EUVD-2026-60308)
vuldb·2026-08-18·CVSS 6.2
CVE-2026-59894 [MEDIUM] andialbrecht sqlparse up to 0.5.x Output output.py sqlparse.format output_format code injection (EUVD-2026-60308)
A vulnerability has been found in andialbrecht sqlparse up to 0.5.x and classified as critical. Affected by this issue is the function sqlparse.format of the file sqlparse/filters/output.py of the component Output. Performing a manipulation of the argument output_format results in code injection.
This vulnerability is cataloged as CVE-2026-59894. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
ghsa·2026-08-17
CVE-2026-59894 [MEDIUM] CWE-94 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
### Summary
The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language string, and place attacker-controlled code into the generated snippet. If a downstream consumer executes or imports that generated source, the injected code runs in the consumer's environment.
### Details
The Python output filter places SQL in a single-quoted string and replaces each single quote with an escaped quote. The PHP output filter performs the equivalent operation for a double-quoted s
No detection rules found.
No public exploits indexed.
2026-08-17
Published