CVE-2026-121008: SQL::Abstract::Tree: XSS via unescaped html profile output

AWAITING NVD

Published November 4, 2026

CISO Take

SQL::Abstract::Tree, a Perl SQL formatting library, fails to HTML-escape SQL text and bind values in its html profile, so an attacker who controls a bind value or part of a query can inject JavaScript into any page that displays the formatted SQL. This is a generic web-tooling flaw rather than an AI-specific one. It matters only where debug panels or query logs in ML dashboards or Perl-based AI front ends render this output. There is no CVSS score, no EPSS data, no KEV listing, no public exploit and no scanner template, so exploitation likelihood is currently low. Upgrade to SQL::Abstract 2.000001_04 or later, and until then avoid rendering html-profile output without escaping it, especially in debug panels reachable in production.

Sources:NVDmetacpan.orgGitHub

What is the risk?

Low to moderate. This is stored or reflected XSS (CWE-79) that requires an application to render html-profile output and an attacker who controls a bind value or SQL fragment. No exploit is public, no KEV or SSVC signal exists, and the package has no tracked AI-package linkage. Real exposure is limited to debug or query-log views, which are typically internal or admin-only, though admin sessions make those targets valuable. Severity is unscored and the CISA SSVC decision is unavailable.

How does the attack unfold?

Initial Access

The attacker injects a script payload through a bind value or SQL fragment the application accepts.

AML.T0049

Exploitation

The application formats the SQL with the html profile and renders it into a page without escaping.

Execution

A privileged user opens the debug panel or query log, and the script runs in their browser session.

AML.T0011.003

Impact

The attacker hijacks the session or performs privileged actions in the management interface.

Initial Access

The attacker injects a script payload through a bind value or SQL fragment the application accepts.

AML.T0049

Exploitation

The application formats the SQL with the html profile and renders it into a page without escaping.

Execution

A privileged user opens the debug panel or query log, and the script runs in their browser session.

AML.T0011.003

Impact

The attacker hijacks the session or performs privileged actions in the management interface.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

5 steps

Upgrade SQL::Abstract to 2.000001_04 or later (see the metacpan changes and the upstream commit 85a75fc).
Until patched, HTML-escape the output of the html profile, or switch to a non-HTML profile and escape at render time.
Disable SQL debug panels and query logs in production or restrict them to trusted admins.
Deploy a strict Content-Security-Policy to limit inline script execution.
Search code for SQL::Abstract::Tree usage with the html profile, and review logs for bind values containing script tags or event-handler attributes.

How is it classified?

Data LeakageSocial EngineeringFrameworkAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-121008?

Is CVE-2026-121008 actively exploited?

No confirmed active exploitation of CVE-2026-121008 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-121008?

1. Upgrade SQL::Abstract to 2.000001_04 or later (see the metacpan changes and the upstream commit 85a75fc). 2. Until patched, HTML-escape the output of the html profile, or switch to a non-HTML profile and escape at render time. 3. Disable SQL debug panels and query logs in production or restrict them to trusted admins. 4. Deploy a strict Content-Security-Policy to limit inline script execution. 5. Search code for SQL::Abstract::Tree usage with the html profile, and review logs for bind values containing script tags or event-handler attributes.

What systems are affected by CVE-2026-121008?

This vulnerability affects the following AI/ML architecture patterns: Web-based ML dashboards, Admin and debug consoles, Application query logging.

What is the CVSS score for CVE-2026-121008?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Web-based ML dashboardsAdmin and debug consolesApplication query logging

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.

Exploitation Scenario

An attacker submits input containing a script payload through a search or form field that ends up as a bind value in a query. The application's debug panel or query log formats the query with the html profile and renders it unescaped. When an administrator or developer opens the panel, the script runs in their authenticated session. The attacker can then steal session tokens or perform privileged actions in an ML operations dashboard.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.