CVE-2026-59894

sqlparse allows code injection via unescaped backslashes in formatted output.

• CVSS 6.2
• 94
• Input Validation and Sanitization
• Remote

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

CVE

CVE-2026-59894

CWE

94

CVSS base score

6.2

Published

2026-08-17

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

sqlparse

Fixed by upgrading

Yes

Solution

Upgrade sqlparse to version 0.6.0 or later.

import re
from sqlparse import tokens as T
from sqlparse.filters import Filter


class OutputPythonFilter(Filter):
    """Generate python code."""

    def __init__(self):
        self._in_string = False

    def process(self, stream):
        """Processes the token stream."""
        yield T.Text, 'sql = (\n"'
        for token in stream:
            if token.is_whitespace:
                val = token.value.replace('\n', '\\n"\n       "')
            else:
                # VULNERABLE: Chained replace calls incorrectly escape sequences containing both backslashes and quotes, allowing string termination.
                val = token.value.replace('\\', '\\\\').replace('"', '\\"')
            yield token.ttype, val
        yield T.Text, '"\n)'

import re
from sqlparse import tokens as T
from sqlparse.filters import Filter


class OutputPythonFilter(Filter):
    """Generate python code."""

    def __init__(self):
        self._in_string = False

    def process(self, stream):
        """Processes the token stream."""
        yield T.Text, 'sql = (\n"'
        for token in stream:
            if token.is_whitespace:
                val = token.value.replace('\n', '\\n"\n       "')
            else:
                # FIX: Use re.sub for a single-pass replacement to correctly escape both backslashes and quotes.
                val = re.sub(r'(["\\])', r'\\\1', token.value)
            yield token.ttype, val
        yield T.Text, '"\n)'

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202659894,
  title        = {{sqlparse allows code injection via unescaped backslashes in formatted output.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-59894},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-59894/}}
}