GHSA-mv45-ff6j-x9jp
CVE Information
DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluates WHERE predicates incorrectly in several cases. In the non-numeric string branch of is_matched, <= returns $val1 ge $val2 and >= returns $val1 le $val2 (Nano.pm:696-697) — the two operators are inverted, so a string range filter selects the complementary row set. Separately, IS (Nano.pm:666) treats an empty string as NULL and ignores its right operand (v IS 5 matches empty-string rows), and the =-on-primary-key fast path (Nano.pm:648-651) matches the literal against the key column as a regex and can report a match when the row lookup returns undef.
SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.
Consequence depends on the caller. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows and the IS / key-equality edge cases match rows that should not — an incorrect-comparison filter bypass (CWE-697, and CWE-863 where the filter is an access-control boundary). Where the predicate is used only for display, it is a correctness defect. There is no SQL injection or code execution.
Fix direction: correct the inverted string <=/>= comparisons; make IS honour its right operand and stop equating '' with NULL; and make the = key fast path compare the literal as a value (not a regex against the column name) and report no match when the underlying lookup returns undef.