sqlparse up to version 0.6.0 contains a code injection flaw (CWE‑94) that permits an attacker to embed PHP expressions inside SQL text. The vulnerability is tied to the OutputPHPFilter handling of unescaped dollar signs, allowing constructs such as ${expr} or {${expr}} to be inserted into double‑quoted strings. When the generated PHP snippet is executed, the arbitrary PHP code runs with the permissions of the web server, compromising confidentiality, integrity, and availability of the affected application.

The affected product is sqlparse from andialbrecht, versions 0.6.0 and earlier. The vulnerability manifests when the output_format option is set to 'php', which is commonly used when generating PHP code from SQL strings. No other vendors are listed as impacted.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only supply malicious SQL text to the vulnerable component; no additional privileges are required beyond normal usage. The tool’s design allows the untrusted text to be processed, so the attack vector is local to the application’s input handling, but the execution occurs in the PHP runtime environment, making this a critical risk.