Key points
- CVE-2026-112307 carries a CVSS score of 8.4, rated as high severity.
- The vulnerability affects sqlparse versions up to and including 0.6.0.
- Attackers can inject PHP expressions using specific dollar-sign sequences in SQL text.
The open-source sqlparse library contains a high-severity security flaw that allows attackers to run arbitrary PHP code on affected systems. According to the National Vulnerability Database, this issue impacts all versions of the library up to and including 0.6.0. The flaw is tracked as CVE-2026-112307 and has been assigned a CVSS score of 8.4.
In plain English
This vulnerability works by tricking the library into treating part of an SQL query as executable PHP code. When a user or attacker supplies SQL text that includes unescaped dollar signs, the library’s OutputPHPFilter component places these inputs into double-quoted strings. If the input contains specific sequences like ${expr} or {${expr}}, the system interprets the content inside the braces as PHP instructions.
The background
The weakness is classified under CWE-94, which covers code injection issues. The National Vulnerability Database records indicate that the flaw allows for PHP code injection without requiring complex exploitation steps beyond supplying the crafted SQL text. This means that any application relying on sqlparse versions through 0.6.0 to generate PHP snippets from SQL data is potentially exposed to remote code execution.
What changes now
Organizations using the sqlparse library must verify their current version immediately. Since the vulnerability exists in all releases up to 0.6.0, any installation using these versions is considered affected. There is no mention of a patched version in the source material, so users should assume no fix is currently available. Teams should monitor vendor announcements for an update that addresses CVE-2026-112307.
Who needs to act first
Teams should prioritize systems that accept external input and process it through sqlparse. Identify servers where the library generates PHP code from SQL queries, as these are the highest risk. Check if any web-facing applications use this library for dynamic code generation. Roll out any future fix by testing in isolated environments first to ensure stability. Back up configurations before applying updates. Reduce exposure by restricting input sources and validating data before it reaches the library. Monitor logs for unusual PHP execution patterns that might indicate exploitation attempts.
What to do and how to stay safe: sqlparse
- Audit your software inventory to identify any systems running sqlparse version 0.6.0 or earlier.
- Implement strict input validation on all SQL data entering systems that use this library to block special characters like dollar signs.
- Monitor server logs for unexpected PHP code execution or anomalies in generated code snippets.
- Wait for an official security update from the vendor before attempting manual code modifications that might break functionality.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 8.4, which is rated as high severity.
Which versions of sqlparse are affected?
All versions of the sqlparse library up to and including 0.6.0 are affected by this flaw.
How do attackers exploit this vulnerability?
Attackers supply SQL text containing unescaped dollar signs in sequences like ${expr}, causing the library to execute arbitrary PHP code.
