CVE-2026-59894
CVE-2026-59894: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.3
Medium [CVE-2026-59894] Arbitrary code execution via unescaped backslashes in generated snippets
CVE-2026-59894Source published Source updated
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0. Successful exploitation could lead to arbitrary code execution, significantly impacting the confidentiality and integrity of the system. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Weakness: CWE-94. Affected Red Hat products: Red Hat Ansible Automation Platform 2; Red Hat Discovery 2; Red Hat OpenShift…
- Affected products in this advisory
- Red Hat Ansible Automation Platform 2
- Red Hat Discovery 2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
7 more entries in the full advisory.
- Source-reported affected versions
- < 0.6.0
- Source-reported fixed versions
- 0.6.0
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.