Hi,

The following vulnerability was published for libsql-abstract-perl.

CVE-2026-121265[0]:
| SQL::Abstract versions before 2.000003 for Perl allow SQL injection
| via an arrayref column value in insert and update.  With the
| array_datatypes option off, which is the default, insert(), update()
| and values() treat an arrayref column value as literal SQL. Its
| first element goes into the SQL text unescaped and the rest become
| bind values. A JSON array, or a repeated form field decoded as an
| arrayref, is such a value.  An application that passes request data
| as column values to insert or update with the default options allows
| SQL injection.  Releases before 2.000003 also treat an arrayref in
| generate() as literal SQL, including through AUTOLOAD when
| allow_autoload is on, whatever array_datatypes is set to.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-121265
https://www.cve.org/CVERecord?id=CVE-2026-121265
[1] https://lists.security.metacpan.org/cve-announce/msg/44960723/

Regards,
Salvatore