Executive brief
sqlparse is a Python library for parsing and formatting SQL queries. When using the optional Python or PHP output modes to generate source-code snippets from SQL, the library fails to properly escape backslashes before quote characters. An attacker who controls the SQL input can inject arbitrary Python or PHP code into the generated snippet. If that snippet is then executed by a downstream application, the attacker's code runs with the privileges of that application.
Technical details
The vulnerability is a code-injection flaw in sqlparse's output formatting filters for Python (CWE-94). The Python output filter wraps SQL in single-quoted strings and escapes quotes; the PHP filter does the same with double-quoted strings. Both fail to escape pre-existing backslashes before applying quote escaping. A backslash immediately before a quote character causes the generated backslash to be escaped instead of the quote, allowing the quote to close the string prematurely. An attacker supplying SQL like `' + injected_code + '` can place arbitrary Python or PHP code into the generated snippet outside the intended SQL string. The flaw is exposed through `sqlparse.format(..., output_format='python')` and `sqlparse.format(..., output_format='php')` APIs, and the command-line `sqlformat -l` options. Code execution is not automatic—the generated snippet must be subsequently executed or imported by downstream tooling—but when it is, the attacker's code runs with full process privileges. A validated proof-of-concept demonstrates code execution via generated Python snippets. The fix is available in version 0.6.0; affected versions are 0.5.5 and earlier.
Affected products
- andialbrecht sqlparse <= 0.5.5
Timeline
- 2026-08-17: disclosed: GitHub Advisory GHSA-3496-9g83-7v6x published
- 2026-08-17: patched: Fixed in sqlparse version 0.6.0
- 2026-08-17: advisory: CVE-2026-59894 assigned