SQL::Abstract: SQL injection via arrayref - CVE-2026-121265

SQL::Abstract is a widely-used Perl library for building parameterized SQL queries. However, CVE-2026-121265 reveals a critical SQL injection vulnerability: when the array_datatypes option is disabled (the default), the insert(), update() and generate() functions interpret arrayref values as literal SQL without parameterization. The first element of the array is inserted into the SQL text without escaping, while the rest become bind values. This allows JSON arrays or repeated form fields, decoded as arrayref by Perl applications, to inject SQL into the database.

The vulnerability was registered publicly on NVD on November 7, 2026. A functioning proof-of-concept was released on a public GitHub repository the same day, confirming exploits via INSERT/UPDATE, exfiltration, privilege escalation and generate()/AUTOLOAD bypass. No in-the-wild exploitation has been reported; however, public PoC availability significantly raises exploitation risk. Perl applications using SQL::Abstract with default options are immediately vulnerable.

Defensive teams must prioritize updating SQL::Abstract to version 2.000003 or later across all production Perl systems. Before updating, conduct an inventory of applications dependent on this library, especially those handling sensitive data or managing privileged access. Review logs for SQL injection signals; audit the database for unauthorized modifications or anomalous access. If immediate update is not feasible, disable AUTOLOAD and restrict arrayref input sources as a temporary mitigation.