sqlparse PHP Injection Flaw Allows Remote Code Execution

The andialbrecht sqlparse library contains a high-severity PHP code injection vulnerability that exposes environments using the tool to remote code execution. This flaw affects versions through 0.6.0 and stems from how the library processes SQL text containing unescaped dollar signs. Security teams should assess their dependency trees immediately to determine if this component is present in their infrastructure.

Root cause

The underlying issue is classified as CWE-94, which relates to improper control of generation of code. The sqlparse library fails to adequately sanitise input when handling SQL text that includes specific variable syntax. When the OutputPHPFilter processes these inputs, it places the content into double-quoted strings without escaping dangerous characters. This behaviour allows embedded expressions to be interpreted as executable code rather than static text.

Attack path

An attacker can exploit this vulnerability by supplying SQL text that contains unescaped dollar signs. Specifically, they can embed sequences such as ${expr} or {${expr}} within the SQL input. When the library generates a PHP snippet using the OutputPHPFilter, these sequences are placed directly into double-quoted strings. Consequently, arbitrary PHP code executes when the generated snippet runs, granting the attacker control over the affected system.

Affected versions

• sqlparse version 0.6.0
• sqlparse versions prior to 0.6.0
• The vulnerability is tracked as CVE-2026-112307

Mitigation

• Review application dependencies to identify any usage of sqlparse up to version 0.6.0.
• Isolate systems that process untrusted SQL input through this library until a fix is available.
• Monitor for unexpected code execution or changes in system behaviour on affected hosts.

Signals worth monitoring

Teams usually detect this type of injection by reviewing web server logs for unusual SQL patterns containing dollar signs. Check whether application logs show the execution of PHP code that was not explicitly triggered by user actions. Look for alerts indicating unexpected process spawns or network connections from the application server. Inspect file integrity monitors for new or modified PHP files in output directories. Verify that input validation filters are correctly rejecting sequences that resemble variable interpolation.

What to do and how to stay safe: sqlparse

• Audit your software supply chain to confirm if sqlparse up to 0.6.0 is in use.
• Implement strict input validation to reject SQL strings containing dollar sign sequences.
• Monitor server logs for signs of arbitrary code execution or unexpected PHP processes.
• Prepare to update the library once the vendor provides a confirmed security patch.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112307?

The National Vulnerability Database rates this vulnerability as CVSS 8.4 HIGH.

Which versions of sqlparse are affected?

All versions of the andialbrecht sqlparse library up to and including 0.6.0 are affected.

How does an attacker exploit this flaw?

Attackers inject PHP expressions by supplying SQL text with unescaped dollar signs, such as ${expr}.