CVE-2026-112307

HIGH 7.3

sqlparse through 0.6.0 PHP Code Injection via output_format='php'

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.

CWE	CWE-94
Vendor	andialbrecht
Product	sqlparse
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for andialbrecht sqlparse

Be the first to know when new high vulnerabilities affecting andialbrecht sqlparse are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

andialbrecht / sqlparse

0 ≤ 0.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/andialbrecht/sqlparse/pull/930 github.com: https://github.com/andialbrecht/sqlparse/blob/0.6.0/sqlparse/filters/output.py vulncheck.com: https://www.vulncheck.com/advisories/sqlparse-through-0.6.0-php-code-injection-via-output-format-php

Credits

xiehuanyi Zachariah Mithani