Published: October 19, 2026 | Last Modified: October 19, 2026
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.