Bug#1153058: libsql-abstract-perl: CVE-2026-121007 CVE-2026-121008 CVE-2026-121009

[Salvatore Bonaccorso]

Source: libsql-abstract-perl
Version: 2.000001-2
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerabilities were published for libsql-abstract-perl.

CVE-2026-121007[0]:
| SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl
| allow SQL injection via the where values of a nested statement in an
| identifier position.  A nested statement such as { -select => ... }
| in a position where plain scalars are identifiers treats its own
| plain scalars as identifiers too. These positions are the select
| list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses
| plugin FROM (-as) and JOIN (to). The values of the statement's
| where, having and set clauses, and the rows of a -values, go into
| the SQL text instead of the bind list, unescaped unless quote_char
| is set. Subselects in a WHERE condition are not affected.  An
| application that passes untrusted input as a where value of such a
| nested statement, expecting it to be bound, allows SQL injection.


CVE-2026-121008[1]:
| SQL::Abstract::Tree versions before 2.000001_04 for Perl allow
| cross-site scripting via unescaped SQL text and bind values in the
| html profile.  The html profile wraps keywords and placeholders in
| span elements and breaks lines with br elements, so its output is
| meant to go into a page as is. The format method does not HTML-
| escape the SQL text or the bind values it fills in around that
| markup.  An application that renders SQL formatted with the html
| profile, such as in a debug panel or query log, allows an attacker
| who controls a bind value or part of the SQL text to embed
| JavaScript in the page.


CVE-2026-121009[2]:
| SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip
| the injection_guard check for function names given with -func.
| injection_guard is documented to apply to every function name, but
| only the { -name => ... } shorthand goes through it. The explicit {
| -func => [ $name, ... ] } form puts $name into the SQL unchecked.
| An application that relies on injection_guard to reject an untrusted
| function name passed with -func allows SQL injection.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-121007
    https://www.cve.org/CVERecord?id=CVE-2026-121007
[1] https://security-tracker.debian.org/tracker/CVE-2026-121008
    https://www.cve.org/CVERecord?id=CVE-2026-121008
[2] https://security-tracker.debian.org/tracker/CVE-2026-121009
    https://www.cve.org/CVERecord?id=CVE-2026-121009

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore