CVE-2026-59894: sqlparse code injection in Python and PHP output modes

CVE-2026-59894 · Severity: medium · CVSS 4 · Published 2026-08-17

sqlparse is a Python library for parsing and formatting SQL queries. When using the optional Python or PHP output modes to generate source-code snippets from SQL, the library fails to properly escape backslashes before quote characters. An attacker who controls the SQL input can inject arbitrary Python or PHP code into the generated snippet. If that snippet is then executed by a downstream application, the attacker's code runs with the privileges of that application.

Technologies: sqlparse (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-59894 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59894 being exploited in the wild.
How severe is CVE-2026-59894?
Medium severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?
sqlparse (PyPI) <= 0.5.5, ECOSYSTEM:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2026-59894?
Yes. sqlparse (PyPI): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59894 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-59894?
Check whether you run sqlparse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sqlparse (PyPI): upgrade to 0.6.0 or later
    pip install "sqlparse>=0.6.0"

Technical details

The vulnerability is a code-injection flaw in sqlparse's output formatting filters for Python (CWE-94). The Python output filter wraps SQL in single-quoted strings and escapes quotes; the PHP filter does the same with double-quoted strings. Both fail to escape pre-existing backslashes before applying quote escaping. A backslash immediately before a quote character causes the generated backslash to be escaped instead of the quote, allowing the quote to close the string prematurely. An attacker supplying SQL like `' + injected_code + '` can place arbitrary Python or PHP code into the generated snippet outside the intended SQL string. The flaw is exposed through `sqlparse.format(..., output_format='python')` and `sqlparse.format(..., output_format='php')` APIs, and the command-line `sqlformat -l` options. Code execution is not automatic—the generated snippet must be subsequently executed or imported by downstream tooling—but when it is, the attacker's code runs with full process privileges. A validated proof-of-concept demonstrates code execution via generated Python snippets. The fix is available in version 0.6.0; affected versions are 0.5.5 and earlier.

Affected products

  • andialbrecht sqlparse <= 0.5.5

Identifiers

  • CVE-2026-59894
  • GHSA-3496-9g83-7v6x
  • PYSEC-2026-3696

Timeline

  • 2026-08-17: disclosed: GitHub Advisory GHSA-3496-9g83-7v6x published
  • 2026-08-17: patched: Fixed in sqlparse version 0.6.0
  • 2026-08-17: advisory: CVE-2026-59894 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.