What is CVE-2026-59894?
CVE-2026-59894 is a vulnerability in sqlparse, a non-validating SQL parser for Python, where output.py fails to properly escape backslashes before quotes in 'python' and 'php' output formats before version 0.6.0. This could allow crafted SQL to terminate the string context and lead to injection attacks. Users should upgrade sqlparse to version 0.6.0 or later.
Azərbaycanca: CVE-2026-59894, Python-un qeyri-validasiya edən SQL parser modulu olan sqlparse-ə təsir edən boşluqdur. 0.6.0 versiyasından əvvəl output.py faylı xüsusi SQL formatlarında ('python', 'php') backslash və dırnaq işarələrini düzgün escapə etmədiyi üçün, zərərli SQL injection riski yaradır. İstifadəçilər sqlparse-i ən azı 0.6.0 versiyasına yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
Which versions of sqlparse are affected by CVE-2026-59894?
This vulnerability affects all versions of the sqlparse library prior to version 0.6.0.
In which output formats does CVE-2026-59894 create an SQL injection risk?
The vulnerability creates an SQL injection risk specifically in the `python` and `php` output formats due to improper escaping of backslashes and quotes.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.