CVE-2026-13766: DBIx::QuickORM (Perl): SQL Injection via Unquoted Identifiers
DBIx::QuickORM for Perl, in versions before 0.000026, can allow SQL injection because caller-supplied SQL identifiers reach the generated SQL without quoting. The record rates it critical, with a CVSS 3.1 base score of 9.8, and maps it to CWE-89. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
DBIx::QuickORM for Perl, in versions before 0.000026, is affected by an SQL injection weakness (CWE-89). The default SQL builder, a subclass of SQL::Abstract, sets the bind type but not the quote character, so identifiers supplied by callers are emitted into SQL unchanged. Values stay placeholder-bound and are not affected by this issue.
Impact
- Applications that pass untrusted input into identifier positions such as order_by may allow an attacker to influence query structure.
- The record notes that row ordering could be made to depend on a sub-select over columns the query did not select.
- Where-clause and update identifier positions could permit further data disclosure and tampering, according to the description.
- The record assigns a CVSS 3.1 base score of 9.8, which indicates high severity for the scored vector.
Affected products and versions
The description states that versions before 0.000026 of DBIx::QuickORM for Perl are affected. The structured affected and fixes fields in the record are empty. The references include the upstream commit patch and the release changes page for 0.000026, which is consistent with that release addressing the issue, although the record does not state this explicitly.
Exploitation status
The CVE is not listed in CISA KEV. The record gives an EPSS probability of 0.00549 with a percentile of 0.44466, dated 2026-10-13. No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Review the changes page for release 0.000026 and the referenced commit, then plan an upgrade of DBIx::QuickORM to that release or later.
- Until upgrading is possible, do not forward untrusted input to identifier positions. Map user choices to a fixed allowlist of column names and ordering options defined by the application.
- Keep user input restricted to values, which are bound as placeholders, rather than to SQL identifiers.
- Review application code paths that pass parameters to order_by, where-clause keys, returning lists, upsert columns and join aliases.
Detection guidance
- Look for requests where ordering, filtering or column parameters contain unexpected characters or structure, and log them for review.
- Monitor database errors that reference unexpected identifiers or SQL syntax originating from the application.
- Audit dependency inventories for DBIx::QuickORM to identify installations older than 0.000026.
Limitations of the available information
The record does not list structured affected products, fixed versions or the exact package distribution name. It does not describe the precise exploitation conditions beyond the general pattern in the description, and the applicability depends on how each application uses the library. Source status is recorded as Deferred, and the NVD and CVE pages linked in the record were not used to verify additional details.
Frequently asked questions
Which versions of DBIx::QuickORM are affected by CVE-2026-13766?
The description states that versions before 0.000026 for Perl are affected. The record does not provide structured affected version ranges.
Is this vulnerability known to be actively exploited?
The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. Continue to monitor official advisories.
What is the main mitigation if upgrading is not immediately possible?
Do not pass untrusted input into SQL identifier positions such as order_by or column lists. Restrict user choices to a fixed allowlist defined by the application.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.