Quick answers
- Is CVE-2026-121265 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121265 being exploited in the wild.
- How severe is CVE-2026-121265?
- Informational severity, published 7 November 2026.
- Which products and versions are affected?
- Perl CPAN SQL::Abstract before 2.000003.
- Is there a fix for CVE-2026-121265?
- Yes: fixed in 2.000003. Until then: Set array_datatypes => 1 explicitly to treat arrayrefs as bind values instead of literal SQL; use the \[ $sql, @bind ] syntax for intentional literal SQL; upgrade to version 2.000003 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121265 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-121265?
- Check whether you run Perl CPAN SQL::Abstract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 2.000003
Set array_datatypes => 1 explicitly to treat arrayrefs as bind values instead of literal SQL; use the \[ $sql, @bind ] syntax for intentional literal SQL; upgrade to version 2.000003 or later.
Technical details
SQL::Abstract before 2.000003 treats arrayref column values as literal SQL in insert(), update(), values(), and generate() methods when array_datatypes is disabled (the default). The first element of the arrayref is inserted unescaped into the SQL text while remaining elements become bind values. An attacker can pass JSON arrays or HTTP form data decoded as arrayrefs to exploit this, achieving SQL injection without authentication or network-level restrictions.
Affected products
- Perl CPAN SQL::Abstract before 2.000003
Timeline
- 2026-11-07: disclosed
- 2026-11-06: patched