CVE-2026-121265

Summary

SQL::Abstract versions before 2.000003 for Perl allow SQL injection when arrayref column values are passed to insert(), update(), or values() with the default array_datatypes option disabled, causing unescaped SQL from the first array element to be injected directly into queries. This occurs because request data (e.g., JSON arrays or repeated form fields decoded as arrayrefs) is treated as literal SQL instead of parameterized values.

Exploitability

Exploitation requires an application to pass unsanitized user-controlled input (e.g., JSON or form data decoded as arrayrefs) directly into insert() or update() calls with default settings and no additional escaping, but the vulnerability is trivial to trigger once such input paths exist.

Blast radius

Successful exploitation enables full database compromise—including read, modify, or delete of all data—and may facilitate lateral movement if the database holds credentials or sensitive application state.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SQL::Abstract version 2.000003 or later, which fixes the vulnerability by properly handling arrayrefs regardless of the array_datatypes setting.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.