sqlparse CVE-2026-112307

Exploitation requires that the consuming application (1) calls sqlparse with output_format='php' (the OutputPHPFilter), a non-default and rarely used formatting mode; (2) passes attacker-influenced SQL text through that formatter; and (3) actually executes, includes, or eval()s the resulting PHP snippet. The injectable sink is a double-quoted PHP string, triggered specifically by unescaped '$' characters forming ${expr} or {${expr}} interpolation sequences. Limiting factors: the PHP output format is niche, no exploitation occurs unless the generated code is run as PHP (a pure parse-and-display pipeline is unaffected), and only versions through 0.6.0 are affected (fixed by PR #930).

Signals conflict sharply between nominal severity and realistic exploitability. The CVSS 4.0 base score of 8.4 (High) is driven by dual high impact (VC:H/VI:H) from arbitrary PHP code execution, but the same vector constrains real-world risk: AV:L means the flaw is not remotely reachable on its own, and UI:P reflects that exploitation only lands once the PHP snippet sqlparse generates is actually executed downstream. No EPSS score is provided in the input, so exploitation probability cannot be quantified - this is a data gap, not a low score. The CVE is NOT in CISA KEV and no public exploit code is referenced, so this is best treated as no public exploit identified at time of analysis; do not read the VulnCheck advisory as evidence of in-the-wild use. Practical risk is well below what 8.4 suggests because exploitation depends on a rare, non-default usage pattern (output_format='php') combined with an application that subsequently evaluates the generated code; absent that chain the bug is inert. Bottom line: a genuine code-injection defect worth patching, but a low-urgency, narrow-surface issue rather than a mass-exploitation priority.

An application uses sqlparse's PHP output formatter (output_format='php') to turn user-submitted SQL into a PHP code snippet, then runs or includes that snippet. An attacker submits SQL text containing a ${expr} sequence, which OutputPHPFilter places unescaped inside a double-quoted PHP string, so when the generated snippet executes the embedded PHP expression is evaluated as code. No public proof-of-concept is referenced, though the vendor patch and regression tests publicly demonstrate the exact payload shapes.