CVE-2026-121008
Last modified
CVE-2026-121008 is a vulnerability of currently unknown severity. SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page..
Description
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | < 2.000001_04 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-121008?
How severe is CVE-2026-121008?
How do I fix CVE-2026-121008?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12098The PowerPress Podcasting plugin by Blubrry plugin for WordP…6.4
- CVE-2026-120987Whale Browser before 5.39.412.57 allows an attacker to bypas…
- CVE-2026-120988billboard.js before 4.1.3 allows an attacker to execute mali…6.1
- CVE-2026-1210The Happy Addons for Elementor plugin for WordPress is vulne…6.4
- CVE-2026-12100The URL Preview plugin for WordPress is vulnerable to Server…7.2
- CVE-2026-121007SQL::Abstract versions from 1.90_01 before 2.000001_04 for P…
- CVE-2026-121009SQL::Abstract versions from 1.90_01 before 2.000001_04 for P…
- CVE-2026-12101IBM Verify Identity Access could allow an administrator to e…8.1
- CVE-2026-12102The UsersWP – Front-end login form, User Registration, User …2.7
- CVE-2026-121020Exposure of Sensitive Information to an Unauthorized Actor (…4.3
- CVE-2026-121021Plaintext Storage of a Password (CWE-256) in the SecurityMan…5.5
- CVE-2026-121022Use of Default Password (CWE-1393) in the web client in Axxo…8.1
Are you affected by CVE-2026-121008?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST