The vulnerability lies in the sqlparse formatter when producing Python or PHP code. The formatter does not escape existing backslashes that appear before a quote character. A crafted SQL string can therefore close a string literal in the generated code, allowing the remainder of the string to be interpreted as code. Downstream consumers that execute or import the generated source are at risk of arbitrary code execution, either in Python or PHP, which can compromise confidentiality, integrity, and availability of the affected system.

The weakness affects the open‑source sqlparse library distributed by andialbrecht. Versions older than 0.6.0 are vulnerable, and the issue was addressed in the 0.6.0 release. Any application that relies on sqlparse.format with output_format set to 'python' or 'php', or uses the sqlformat -l command, may be exposed if it processes untrusted SQL input.

The CVSS score of 6.2 indicates a medium severity vulnerability. The EPSS score is not available, and the flaw is not cataloged in CISA’s KEV list. Exploitation requires that an attacker can supply custom SQL to the formatter and that the resulting code is executed by the application. While the attack vector is not purely remote, a compromised application could serve as the entry point for malicious input, making the risk dependent on how sqlparse is integrated into the code base.