The SQL::Abstract::Tree library fails to escape SQL text or bind values when generating a formatted string using its html profile. The output is intended to be inserted directly into an HTML page, and the lack of escaping allows an attacker who can influence a keyword, placeholder or bound value to embed arbitrary HTML or JavaScript. This results in stored or reflected client‑side code execution, with the potential to hijack sessions, deface pages, or launch phishing attacks. The weakness is a classic Cross‑Site Scripting flaw (CWE‑79).

Perl environments that use the CPAN module SQL::Abstract::Tree with a version earlier than 2.000001_04 are affected. Any deployment that renders the html profile output—such as debugging panels, query logs, or custom reports—without additional escaping could be vulnerable. The issue is resolved by upgrading to SQL‑Abstract 2.000001_04 or later.

The flaw is client‑side and requires that the unescaped html profile output be exposed in a browser context. If the application provides such output to users, an attacker who can set or modify a bind value or a SQL fragment can inject JavaScript. No EPSS data exists and the vulnerability is not listed in the CISA KEV catalog, yet the ease of exploitation in typical debug environments gives the risk a moderate to high level. Because the flaw allows arbitrary code execution in the victim’s browser, the practical impact remains severe even without an available CVSS score.