phpMyAdmin SQL-Parser CVE-2026-121262

Exploitation requires that a consuming application use phpMyAdmin SQL-Parser version 6.0.0 or 6.0.1 and pass attacker-controlled SQL - specifically an EXPLAIN statement reaching ExplainStatement::parse with a manipulated nextToken - into the parser. Limiting factors: only these two library versions are affected; the parser itself imposes no authentication (PR:N), so the practical limit is whether the embedding application exposes SQL parsing of untrusted input; and impact is confined to availability (VA:L) with no confidentiality or integrity effect. The precise malformed input needed to trigger the incorrect type conversion is not described in the available sources beyond manipulation of nextToken.

This is a genuine but moderate-priority issue, not a high-severity emergency. The supplied CVSS 4.0 vector scores 5.5 (medium) and is internally consistent with a low-impact flaw: AV:N/AC:L/AT:N/PR:N/UI:N indicates a network-reachable, low-complexity trigger needing no privileges or user interaction, but the only impact is VC:N/VI:N/VA:L - availability-only, and only 'low'. There is no confidentiality or integrity impact per the vector, which directly conflicts with the input 'Information Disclosure' tag; that tag appears mislabeled and should not be used to raise urgency. Exploit maturity is E:P (proof-of-concept), matching the input note that the PoC is a reference only, not verified as working exploit code. No EPSS score was provided in the input, so probability-of-exploitation cannot be weighed; this gap should be noted rather than assumed low or high. The CVE is not listed in CISA KEV, so there is no evidence of active exploitation - a public PoC reference exists but that is a distinct, weaker signal. The vuln.today decision label is 'this_month', consistent with a non-urgent, schedulable fix rather than act_now/emergency. Net assessment: a remotely-triggerable denial-of-service-class weakness (incorrect type conversion, CWE-704) in a specific library, worth patching on a normal cycle, not a drop-everything event.

An application that uses phpMyAdmin SQL-Parser 6.0.0 or 6.0.1 to parse untrusted SQL passes an attacker-supplied EXPLAIN statement to the parser; the handling of nextToken in ExplainStatement::parse performs an incorrect type conversion, producing an error or crash that degrades availability (VA:L). Because AV:N/AC:L/PR:N/UI:N applies to the parser, no authentication or user interaction is needed at the library level, though reachability depends on the consuming application exposing SQL parsing to attacker input. A public PoC reference exists (a GitHub gist); it is not verified as working exploit code.