CVE-2026-13766 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-13766 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-13766 is a SQL injection vulnerability in the Perl module DBIx::QuickORM, affecting all versions prior to 0.000026, caused by improper handling of SQL identifiers in the library's default query builder.

Technical Detail

The vulnerability originates in DBIx::QuickORM's default SQL builder, which is implemented as a subclass of SQL::Abstract. The constructor correctly sets the bindtype option but fails to set quote_char, meaning SQL identifiers such as table and column names are interpolated into queries without quoting or escaping. An attacker who can influence identifier values passed to the ORM can inject arbitrary SQL, potentially leading to unauthorized data access, data manipulation, or, depending on database configuration and permissions, command execution via database-native features.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. This does not preclude opportunistic exploitation, as SQL injection primitives of this class are well understood and straightforward to weaponize once a target is identified.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE as of July 07, 2026.

What To Do

Upgrade DBIx::QuickORM to version 0.000026 or later immediately. This is the only confirmed remediation. Organizations using affected versions in production Perl applications should treat this as a high-priority patch given the critical CVSS score of 9.8 and the ease with which SQL injection vulnerabilities can be exploited once discovered. As an interim measure, review all code paths that pass externally influenced values as SQL identifiers through the ORM and apply allowlist validation or manual quoting where possible. Detection should focus on anomalous SQL query patterns in database logs, particularly queries containing unexpected identifier structures or stacked statements. No CISA binding directive applies at this time as the vulnerability is not KEV-listed.