sqlparse Package Vulnerability: SQL Injection Risk Through Unescaped Backslashes

Severity

HIGH

Affected component

sqlparse (pypi)

Affected versions

< 0.5.4 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or < 0.5.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5 or >= 0.4.0, < 0.4.2 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5 or >= 0.1.15, < 0.4.4 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.0, < 0.4.2 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.1.15, < 0.4.4 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or < 0.5.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5 or < 0.6.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.10, <= 0.1.10 or >= 0.1.11, <= 0.1.11 or >= 0.1.12, <= 0.1.12 or >= 0.1.13, <= 0.1.13 or >= 0.1.14, <= 0.1.14 or >= 0.1.15, <= 0.1.15 or >= 0.1.16, <= 0.1.16 or >= 0.1.17, <= 0.1.17 or >= 0.1.18, <= 0.1.18 or >= 0.1.19, <= 0.1.19 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.3, <= 0.5.3 or >= 0.5.4, <= 0.5.4 or >= 0.5.5, <= 0.5.5

Patched version

Not yet available

An early warning has been issued regarding a vulnerability in the sqlparse package that could allow SQL injection through unescaped backslashes. Users of affected versions are advised to take precautions.

What happened

The sqlparse package, which generates Python and PHP code snippets from SQL input, has been found to improperly escape backslashes. This oversight allows for SQL injection attacks, where malicious SQL code can be injected into the generated snippets. The vulnerability affects a wide range of versions, from 0.1.0 to 0.5.3, and below 0.5.4. It is crucial for users to assess their exposure by checking the versions of sqlparse in use within their projects.

This vulnerability has not been exploited in the wild as of the latest reports. However, the potential for exploitation is high, given the nature of the flaw. It is recommended that users avoid using the affected output modes in sqlparse until a patch is released to mitigate the risk of SQL injection.

What to do about it

• Check the version of sqlparse used in your projects against the affected version ranges provided.
• Avoid using the affected output modes in sqlparse to prevent potential SQL injection attacks.
• Monitor the official sources for updates on a patch release.
• Consider alternative libraries or manual code reviews for SQL generation until the issue is resolved.
• No official fix has been published yet. Monitor the sources below for updates.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [GHSA-3496-9g83-7v6x] sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Join the 0Day waitlist →

← Back to all threats