MEDIUM 6.2 NVD

CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlp

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

References

https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x

Published: 2026-08-17 · Source: NVD · Feed updated: 2026-08-17

This medium severity vulnerability with a CVSS score of 6.2 was published on 2026-08-17 via NVD.

vulnfeed aggregates 11030 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.