sqlparse: PHP code injection via unescaped dollar signs in PHP output format
Summary
sqlparse, a Python SQL parsing library, contains a code injection flaw in its PHP output format (output_format='php'). Unescaped dollar signs in SQL text are placed into double-quoted PHP strings, so an attacker can embed ${expr} sequences that execute arbitrary PHP code when the generated snippet runs. Exploitation requires that an application converts untrusted SQL with this output format and executes the result; the CVSS vector assumes local access and user interaction.
Affected
- sqlparse 0.6.0 and earlier (affected range 0 to <= 0.6.0 per VulnCheck)
- Only applications that use the PHP output format on untrusted SQL text are exposed
Fixed in
Unknown. No fixed version is confirmed for this CVE. Upgrading to 0.6.0 does not fix it, as 0.6.0 is within the affected range.
Workaround
- Do not use the PHP output format (output_format='php') for untrusted input
- Do not execute or import generated PHP or Python snippets from sqlparse
- Check whether your code or dependencies use these output modes at all
Exploitation
- No known exploitation in the wild
- CISA SSVC (VulnCheck): exploitation none, automatable no, technical impact total
- Not listed in CISA KEV
- No public proof of concept found during research
Our recommendation
- Search Python projects and lock files (including transitive dependencies) for sqlparse
- Check whether any code uses the PHP output format on untrusted input and stop that use
- Track the GitHub advisory and PR #930 for a confirmed fixed version and upgrade when available
- Re-check the NVD entry, which is currently listed as Deferred
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- sqlparse output.py at 0.6.0 github.com
- sqlparse pull request #930 github.com
- Ubuntu CVE-2026-112307 ubuntu.com
- OpenCVE CVE-2026-112307 app.opencve.io
- Aikido Intel AIKIDO-2026-576438 intel.aikido.dev
- OpenCVE CVE-2026-59894 (related) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:18.
Original description (NVD)
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.