========================================================================
CVE-2026-121008                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-121008

   Distribution:  SQL-Abstract
       Versions:  before 2.000001_04
       MetaCPAN:  https://metacpan.org/dist/SQL-Abstract
       VCS Repo:  https://github.com/dbsrgits/sql-abstract

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow
cross-site scripting via unescaped SQL text and bind values in the html
profile

Description
-----------
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow
cross-site scripting via unescaped SQL text and bind values in the html
profile.

The html profile wraps keywords and placeholders in span elements and
breaks lines with br elements, so its output is meant to go into a page
as is. The format method does not HTML-escape the SQL text or the bind
values it fills in around that markup.

An application that renders SQL formatted with the html profile, such
as in a debug panel or query log, allows an attacker who controls a
bind value or part of the SQL text to embed JavaScript in the page.

Problem types
-------------
- CWE-79 Improper Neutralization of Input During Web Page Generation
   ('Cross-site Scripting')

Solutions
---------
Upgrade to SQL-Abstract 2.000001_04 or later.

References
----------
https://github.com/dbsrgits/sql-abstract/commit/85a75fcde3e09da5181dee07a4eccba76ad94305.patch
https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes