package/python-sqlparse: backport fix for CVE-2026-59894
PATCH 1/2 package/python-sqlparse: backport fix for CVE-2026-59894
Fixes the following vulnerability:
- CVE-2026-59894:
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-59894
- https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x
- https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63
--- ...ape-backslashes-in-output-formatters.patch | 49 +++++++++++++++++++ package/python-sqlparse/python-sqlparse.mk | 3 ++ 2 files changed, 52 insertions(+) create mode 100644 package/python-sqlparse/0001-Escape-backslashes-in-output-formatters.patch
package/python-sqlparse/0001-Escape-backslashes-in-output-formatters.patch new file +49 -0
@@ -0,0 +1,49 @@ +From 53ff44b53e27cff78259acc1af015506fea60f63 Mon Sep 17 00:00:00 2001 +From: Andi Albrecht <[email protected]> +Date: Mon, 29 Jun 2026 08:29:32 +0200 +Subject: [PATCH] Escape backslashes in output formatters. + +CVE: CVE-2026-59894 +Upstream: https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63 +[thomas: backport: + - stripped tests and changelog +] +Signed-off-by: Thomas Perale <[email protected]> +--- + sqlparse/filters/output.py | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/sqlparse/filters/output.py b/sqlparse/filters/output.py +index 253537e..697ebc3 100644 +--- a/sqlparse/filters/output.py ++++ b/sqlparse/filters/output.py +@@ -61,9 +61,11 @@ class OutputPythonFilter(OutputFilter): + yield sql.Token(T.Whitespace, after_lb) + continue + +- # Token has escape chars +- elif "'" in token.value: +- token.value = token.value.replace("'", "\\'") ++ # Escape backslashes before quotes so a backslash preceding a ++ # quote cannot break out of the generated string literal ++ # (GHSA-3496-9g83-7v6x). ++ else: ++ token.value = token.value.replace('\\', '\\\\').replace("'", "\\'") + + # Put the token + yield sql.Token(T.Text, token.value) +@@ -110,9 +112,11 @@ class OutputPHPFilter(OutputFilter): + yield sql.Token(T.Whitespace, after_lb) + continue + +- # Token has escape chars +- elif '"' in token.value: +- token.value = token.value.replace('"', '\\"') ++ # Escape backslashes before quotes so a backslash preceding a ++ # quote cannot break out of the generated string literal ++ # (GHSA-3496-9g83-7v6x). ++ else: ++ token.value = token.value.replace('\\', '\\\\').replace('"', '\\"') + + # Put the token + yield sql.Token(T.Text, token.value)
package/python-sqlparse/python-sqlparse.mk +3 -0
@@ -13,4 +13,7 @@ PYTHON_SQLPARSE_LICENSE_FILES = LICENSE PYTHON_SQLPARSE_CPE_ID_VENDOR = sqlparse_project PYTHON_SQLPARSE_CPE_ID_PRODUCT = sqlparse +# 0001-Escape-backslashes-in-output-formatters.patch +PYTHON_SQLPARSE_IGNORE_CVES += CVE-2026-59894 + $(eval $(python-package))
Signature · 6 lines
2.56.0 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
PATCH 2/2 package/python-sqlparse: backport fix for CVE-2026-112307
Fixes the following vulnerability:
- CVE-2026-112307:
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-112307
- https://github.com/advisories/GHSA-457h-p88w-wq8p
- https://github.com/andialbrecht/sqlparse/pull/937/changes/bb3c50a52dc2f267c786f0d99c27b25519f9331f
--- ...pe-dollar-signs-in-PHP-output-format.patch | 45 +++++++++++++++++++ package/python-sqlparse/python-sqlparse.mk | 3 ++ 2 files changed, 48 insertions(+) create mode 100644 package/python-sqlparse/0002-fix-escape-dollar-signs-in-PHP-output-format.patch
package/python-sqlparse/0002-fix-escape-dollar-signs-in-PHP-output-format.patch new file +45 -0
@@ -0,0 +1,45 @@ +From bb3c50a52dc2f267c786f0d99c27b25519f9331f Mon Sep 17 00:00:00 2001 +From: cve-zh00 <[email protected]> +Date: Tue, 20 Oct 2026 10:56:23 -0300 +Subject: [PATCH] fix: escape dollar signs in PHP output format + (CVE-2026-112307) + +PHP interpolates $var, ${expr} and {$expr} inside double-quoted strings, +so SQL text containing them could inject PHP code into the snippet +generated by output_format='php'. Escape "$" as "\$" after the existing +backslash and double-quote escaping. + +Adds regression tests for SQL literals, ${expr}/{${expr}} payloads, +PostgreSQL dollar quoting, quoted identifiers, comments and a preceding +backslash. + +CVE: CVE-2026-112307 +Upstream: https://github.com/andialbrecht/sqlparse/commit/bb3c50a52dc2f267c786f0d99c27b25519f9331f +[thomas: backport: + - stripped tests and changelog +] +Signed-off-by: Thomas Perale <[email protected]> +--- + sqlparse/filters/output.py | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sqlparse/filters/output.py b/sqlparse/filters/output.py +index 697ebc3..06015ec 100644 +--- a/sqlparse/filters/output.py ++++ b/sqlparse/filters/output.py +@@ -114,9 +114,13 @@ class OutputPHPFilter(OutputFilter): + + # Escape backslashes before quotes so a backslash preceding a + # quote cannot break out of the generated string literal +- # (GHSA-3496-9g83-7v6x). ++ # (GHSA-3496-9g83-7v6x). Dollar signs are escaped last because ++ # PHP interpolates $var, ${expr} and {$expr} inside double-quoted ++ # strings (CVE-2026-112307). + else: +- token.value = token.value.replace('\\', '\\\\').replace('"', '\\"') ++ token.value = (token.value.replace('\\', '\\\\') ++ .replace('"', '\\"') ++ .replace('$', '\\$')) + + # Put the token + yield sql.Token(T.Text, token.value)
package/python-sqlparse/python-sqlparse.mk +3 -0
@@ -16,4 +16,7 @@ PYTHON_SQLPARSE_CPE_ID_PRODUCT = sqlparse # 0001-Escape-backslashes-in-output-formatters.patch PYTHON_SQLPARSE_IGNORE_CVES += CVE-2026-59894 +# 0002-fix-escape-dollar-signs-in-PHP-output-format.patch +PYTHON_SQLPARSE_IGNORE_CVES += CVE-2026-112307 + $(eval $(python-package))
Signature · 6 lines
2.56.0 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot