PyPI/sqlparse CVE-2026-59894: medium, EPSS 0.13%

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Action: Upgrade sqlparse to 0.6.0 or later.

pip install sqlparse==0.6.0

Affected

Fixed versions

Sources

• osv: GHSA-3496-9g83-7v6x
• https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x
• https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63
• https://github.com/andialbrecht/sqlparse

CVE-2026-59894 · published 2026-08-17T17:20:11Z · modified 2026-09-10T03:51:12.861315402Z · JSON