========================================================================
CVE-2026-121009                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-121009

   Distribution:  SQL-Abstract
       Versions:  from 1.90_01 before 2.000001_04
       MetaCPAN:  https://metacpan.org/dist/SQL-Abstract
       VCS Repo:  https://github.com/dbsrgits/sql-abstract

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip
the injection_guard check for function names given with -func

Description
-----------
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip
the injection_guard check for function names given with -func.

injection_guard is documented to apply to every function name, but only
the { -name => ... } shorthand goes through it. The explicit { -func =>
[ $name, ... ] } form puts $name into the SQL unchecked.

An application that relies on injection_guard to reject an untrusted
function name passed with -func allows SQL injection.

Problem types
-------------
- CWE-89 Improper Neutralization of Special Elements used in an SQL
   Command ('SQL Injection')

Solutions
---------
Upgrade to SQL-Abstract 2.000001_04 or later.

References
----------
https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch
https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes