Upstream information
Description
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.
An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.
SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
SUSE Bugzilla entry: 1289544 [NEW] No SUSE Security Announcements cross referenced.List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2026-12469 |
SUSE Timeline for this CVE
CVE page created: Thu Nov 5 15:56:41 2026CVE page last modified: Sat Nov 7 12:58:18 2026