{
  "affected": [
    {
      "affectedData": [
        {
          "product": "sqlparse",
          "vendor": "andialbrecht",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format=\u0027python\u0027 and output_format=\u0027php\u0027 and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0."
    }
  ],
  "id": "CVE-2026-59894",
  "lastModified": "2026-08-17T22:17:16.023",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59894",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-17T21:29:10.782733Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-17T18:17:35.913",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "sqlparse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T17:20:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language string, and place attacker-controlled code into the generated snippet. If a downstream consumer executes or imports that generated source, the injected code runs in the consumer\u0027s environment.\n\n### Details\n\nThe Python output filter places SQL in a single-quoted string and replaces each single quote with an escaped quote. The PHP output filter performs the equivalent operation for a double-quoted string. Neither transformation escapes pre-existing backslashes before escaping quotes. A backslash supplied immediately before a quote causes the generated backslash to be escaped instead of the quote, allowing the quote to close the string.\n\nThe affected modes are exposed through `sqlparse.format(..., output_format=\u0027python\u0027)`, `sqlparse.format(..., output_format=\u0027php\u0027)`, and the corresponding `sqlformat -l` options. Formatting produces the injected source but does not itself execute it; code execution occurs when a downstream workflow treats the generated snippet as Python or PHP code.\n\nRelevant code locations:\n\n- `sqlparse/formatter.py:193` \u2014 selection of the output-language filters\n- `sqlparse/filters/output.py:45` \u2014 opening of the generated Python string\n- `sqlparse/filters/output.py:65` \u2014 incomplete Python quote escaping\n- `sqlparse/filters/output.py:91` \u2014 opening of the generated PHP string\n- `sqlparse/filters/output.py:114` \u2014 incomplete PHP quote escaping\n\n### PoC\n\nA complete validated reproduction is attached as [output_format_snippet_injection-poc.zip](https://github.com/user-attachments/files/29410134/output_format_snippet_injection-poc.zip). The archive contains `reproduction/` at its root, uses Git and Docker, and validates the Python output path by generating and executing a snippet containing a controlled marker-file write.\n\nExtract the archive beside this report, then run:\n\n```console\n./reproduction/run.sh\n```\n\nObserved result:\n\nThe generated Python snippet placed the attacker-controlled `pathlib.Path(...).write_text(...)` expression outside the intended SQL string. Executing the snippet wrote the expected proof marker, emitted `EVOHUNT_OUTPUT_FORMAT_INJECTION_VERIFIED`, and completed successfully.\n\nVerification method:\n\nThe verification helper calls `sqlparse.format(..., output_format=\u0027python\u0027)`, executes the generated snippet, and fails unless the injected Python expression writes the exact proof marker file.\n\nLimitations:\n\nNo reproduction blocker was recorded. The attached harness directly verifies the Python output path; exploitation also requires a downstream consumer to execute or import the generated source.\n\n### Impact\n\nThis is source-code injection in the opt-in Python and PHP snippet-generation modes. An attacker who controls SQL converted by one of these modes can inject language code into the generated artifact. If that artifact is subsequently executed, the attacker can run code with the permissions and access of the downstream Python or PHP process.\n\nThe demonstrated end-to-end result is code execution through a generated Python snippet. Formatting the SQL alone does not execute the payload, and ordinary parsing, splitting, or formatting without these output modes is not shown to be affected.",
  "id": "GHSA-3496-9g83-7v6x",
  "modified": "2026-08-17T17:20:11Z",
  "published": "2026-08-17T17:20:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/andialbrecht/sqlparse"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-sqlparse-0.6.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-sqlparse-0.6.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11557",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11557-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54284 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54284/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59893 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59893/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59894 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59894/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-71491 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-71491/"
      }
    ],
    "title": "python313-sqlparse-0.6.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-08-19T00:00:00Z",
      "generator": {
        "date": "2026-08-19T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11557-1",
      "initial_release_date": "2026-08-19T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-19T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-sqlparse-0.6.0-1.1.aarch64",
                "product": {
                  "name": "python313-sqlparse-0.6.0-1.1.aarch64",
                  "product_id": "python313-sqlparse-0.6.0-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-sqlparse-0.6.0-1.1.aarch64",
                "product": {
                  "name": "python314-sqlparse-0.6.0-1.1.aarch64",
                  "product_id": "python314-sqlparse-0.6.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-sqlparse-0.6.0-1.1.ppc64le",
                "product": {
                  "name": "python313-sqlparse-0.6.0-1.1.ppc64le",
                  "product_id": "python313-sqlparse-0.6.0-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-sqlparse-0.6.0-1.1.ppc64le",
                "product": {
                  "name": "python314-sqlparse-0.6.0-1.1.ppc64le",
                  "product_id": "python314-sqlparse-0.6.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-sqlparse-0.6.0-1.1.s390x",
                "product": {
                  "name": "python313-sqlparse-0.6.0-1.1.s390x",
                  "product_id": "python313-sqlparse-0.6.0-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-sqlparse-0.6.0-1.1.s390x",
                "product": {
                  "name": "python314-sqlparse-0.6.0-1.1.s390x",
                  "product_id": "python314-sqlparse-0.6.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-sqlparse-0.6.0-1.1.x86_64",
                "product": {
                  "name": "python313-sqlparse-0.6.0-1.1.x86_64",
                  "product_id": "python313-sqlparse-0.6.0-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-sqlparse-0.6.0-1.1.x86_64",
                "product": {
                  "name": "python314-sqlparse-0.6.0-1.1.x86_64",
                  "product_id": "python314-sqlparse-0.6.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-sqlparse-0.6.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64"
        },
        "product_reference": "python313-sqlparse-0.6.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-sqlparse-0.6.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le"
        },
        "product_reference": "python313-sqlparse-0.6.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-sqlparse-0.6.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x"
        },
        "product_reference": "python313-sqlparse-0.6.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-sqlparse-0.6.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64"
        },
        "product_reference": "python313-sqlparse-0.6.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-sqlparse-0.6.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64"
        },
        "product_reference": "python314-sqlparse-0.6.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-sqlparse-0.6.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le"
        },
        "product_reference": "python314-sqlparse-0.6.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-sqlparse-0.6.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x"
        },
        "product_reference": "python314-sqlparse-0.6.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-sqlparse-0.6.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
        },
        "product_reference": "python314-sqlparse-0.6.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54284",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54284"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54284",
          "url": "https://www.suse.com/security/cve/CVE-2026-54284"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275459 for CVE-2026-54284",
          "url": "https://bugzilla.suse.com/1275459"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54284"
    },
    {
      "cve": "CVE-2026-59893",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59893"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59893",
          "url": "https://www.suse.com/security/cve/CVE-2026-59893"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275461 for CVE-2026-59893",
          "url": "https://bugzilla.suse.com/1275461"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59893"
    },
    {
      "cve": "CVE-2026-59894",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59894"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format=\u0027python\u0027 and output_format=\u0027php\u0027 and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59894",
          "url": "https://www.suse.com/security/cve/CVE-2026-59894"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275460 for CVE-2026-59894",
          "url": "https://bugzilla.suse.com/1275460"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59894"
    },
    {
      "cve": "CVE-2026-71491",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-71491"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-71491",
          "url": "https://www.suse.com/security/cve/CVE-2026-71491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275466 for CVE-2026-71491",
          "url": "https://bugzilla.suse.com/1275466"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-sqlparse-0.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-sqlparse-0.6.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-71491"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-sqlparse",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-sqlparse fixes the following issues:\n\n- CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial\n  of service via excessive resource consumption (bsc#1275459).\n- CVE-2026-59893: quadratic complexity when processing unmatched dollar-quoted literal and multiline-comment delimiters\n  can lead to denial of service (bsc#1275461).\n- CVE-2026-59894: improper backlash escaping allows for injection of Python or PHP code via a crafted SQL input\n  (bsc#1275460).\n- CVE-2026-71491: quadratic complexity in `group_comments` when processing comment-only statements can lead to denial\n  of services (bsc#1275466).\n- Incomplete GHSA-27jp-wm6q-gp25 patch (bsc#1268597).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1546",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21690-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268597",
        "url": "https://bugzilla.suse.com/1268597"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1275459",
        "url": "https://bugzilla.suse.com/1275459"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1275460",
        "url": "https://bugzilla.suse.com/1275460"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1275461",
        "url": "https://bugzilla.suse.com/1275461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1275466",
        "url": "https://bugzilla.suse.com/1275466"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54284 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54284/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59893 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59893/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59894 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59894/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-71491 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-71491/"
      }
    ],
    "title": "Security update for python-sqlparse",
    "tracking": {
      "current_release_date": "2026-08-30T14:33:33Z",
      "generator": {
        "date": "2026-08-30T14:33:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21690-1",
      "initial_release_date": "2026-08-30T14:33:33Z",
      "revision_history": [
        {
          "date": "2026-08-30T14:33:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-sqlparse-0.5.3-160000.4.1.noarch",
                "product": {
                  "name": "python313-sqlparse-0.5.3-160000.4.1.noarch",
                  "product_id": "python313-sqlparse-0.5.3-160000.4.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-sqlparse-0.5.3-160000.4.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
        },
        "product_reference": "python313-sqlparse-0.5.3-160000.4.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54284",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54284"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54284",
          "url": "https://www.suse.com/security/cve/CVE-2026-54284"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275459 for CVE-2026-54284",
          "url": "https://bugzilla.suse.com/1275459"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54284"
    },
    {
      "cve": "CVE-2026-59893",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59893"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59893",
          "url": "https://www.suse.com/security/cve/CVE-2026-59893"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275461 for CVE-2026-59893",
          "url": "https://bugzilla.suse.com/1275461"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59893"
    },
    {
      "cve": "CVE-2026-59894",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59894"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format=\u0027python\u0027 and output_format=\u0027php\u0027 and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59894",
          "url": "https://www.suse.com/security/cve/CVE-2026-59894"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275460 for CVE-2026-59894",
          "url": "https://bugzilla.suse.com/1275460"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59894"
    },
    {
      "cve": "CVE-2026-71491",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-71491"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-71491",
          "url": "https://www.suse.com/security/cve/CVE-2026-71491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275466 for CVE-2026-71491",
          "url": "https://bugzilla.suse.com/1275466"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-71491"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sqlparse",
        "purl": "pkg:pypi/sqlparse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "0.1.10",
        "0.1.11",
        "0.1.12",
        "0.1.13",
        "0.1.14",
        "0.1.15",
        "0.1.16",
        "0.1.17",
        "0.1.18",
        "0.1.19",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.3.0",
        "0.3.1",
        "0.4.0",
        "0.4.1",
        "0.4.2",
        "0.4.3",
        "0.4.4",
        "0.5.0",
        "0.5.1",
        "0.5.2",
        "0.5.3",
        "0.5.4",
        "0.5.5"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59894",
    "GHSA-3496-9g83-7v6x"
  ],
  "details": "### Summary\n\nThe documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language string, and place attacker-controlled code into the generated snippet. If a downstream consumer executes or imports that generated source, the injected code runs in the consumer\u0027s environment.\n\n### Details\n\nThe Python output filter places SQL in a single-quoted string and replaces each single quote with an escaped quote. The PHP output filter performs the equivalent operation for a double-quoted string. Neither transformation escapes pre-existing backslashes before escaping quotes. A backslash supplied immediately before a quote causes the generated backslash to be escaped instead of the quote, allowing the quote to close the string.\n\nThe affected modes are exposed through `sqlparse.format(..., output_format=\u0027python\u0027)`, `sqlparse.format(..., output_format=\u0027php\u0027)`, and the corresponding `sqlformat -l` options. Formatting produces the injected source but does not itself execute it; code execution occurs when a downstream workflow treats the generated snippet as Python or PHP code.\n\nRelevant code locations:\n\n- `sqlparse/formatter.py:193` \u2014 selection of the output-language filters\n- `sqlparse/filters/output.py:45` \u2014 opening of the generated Python string\n- `sqlparse/filters/output.py:65` \u2014 incomplete Python quote escaping\n- `sqlparse/filters/output.py:91` \u2014 opening of the generated PHP string\n- `sqlparse/filters/output.py:114` \u2014 incomplete PHP quote escaping\n\n### PoC\n\nA complete validated reproduction is attached as [output_format_snippet_injection-poc.zip](https://github.com/user-attachments/files/29410134/output_format_snippet_injection-poc.zip). The archive contains `reproduction/` at its root, uses Git and Docker, and validates the Python output path by generating and executing a snippet containing a controlled marker-file write.\n\nExtract the archive beside this report, then run:\n\n```console\n./reproduction/run.sh\n```\n\nObserved result:\n\nThe generated Python snippet placed the attacker-controlled `pathlib.Path(...).write_text(...)` expression outside the intended SQL string. Executing the snippet wrote the expected proof marker, emitted `EVOHUNT_OUTPUT_FORMAT_INJECTION_VERIFIED`, and completed successfully.\n\nVerification method:\n\nThe verification helper calls `sqlparse.format(..., output_format=\u0027python\u0027)`, executes the generated snippet, and fails unless the injected Python expression writes the exact proof marker file.\n\nLimitations:\n\nNo reproduction blocker was recorded. The attached harness directly verifies the Python output path; exploitation also requires a downstream consumer to execute or import the generated source.\n\n### Impact\n\nThis is source-code injection in the opt-in Python and PHP snippet-generation modes. An attacker who controls SQL converted by one of these modes can inject language code into the generated artifact. If that artifact is subsequently executed, the attacker can run code with the permissions and access of the downstream Python or PHP process.\n\nThe demonstrated end-to-end result is code execution through a generated Python snippet. Formatting the SQL alone does not execute the payload, and ordinary parsing, splitting, or formatting without these output modes is not shown to be affected.",
  "id": "PYSEC-2026-3696",
  "modified": "2026-08-19T12:16:39.119951Z",
  "published": "2026-08-19T11:56:26.811298Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/andialbrecht/sqlparse"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/sqlparse"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-3496-9g83-7v6x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59894"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes"
}