Andialbrecht Sqlparse vulnerabilities

CVE-2026-54284 [HIGH] CWE-407 CVE-2026-54284: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction an sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token l

CVE-2026-71491 [HIGH] CWE-400 CVE-2026-71491: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlpars sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.

CVE-2021-32839 [HIGH] CWE-400 CVE-2021-32839: sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 ther sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL

CVE-2026-112307 [HIGH] CWE-94 CVE-2026-112307: sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject P sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.

CVE-2026-59893 [HIGH] CWE-1333 CVE-2026-59893: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/key sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is

CVE-2023-30608 [HIGH] CWE-1333 CVE-2023-30608: sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser conta sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c

CVE-2026-59894 [MEDIUM] CWE-94 CVE-2026-59894: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.p sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a

CVE-2026-84305 [MEDIUM] CWE-407 CVE-2026-84305: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, rein sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of