Skip to content
Insights · weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command

Sources read 2026-10-29. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days

What it is

From MITRE's CWE catalogue

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

MITRE classes it as a base-level weakness and rates the likelihood of exploit as high.

What it lets an attacker do

From MITRE's CWE catalogue

  • Execute Unauthorized Code or Commands (affects: confidentiality, integrity, availability)
  • Read Application Data (affects: confidentiality)
  • Gain Privileges or Assume Identity, Bypass Protection Mechanism (affects: authentication)
  • Bypass Protection Mechanism (affects: access control)

On CISA's exploited list

From CISA's exploited list

4 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-89, against 3 of 69 in the 90 days before. Over the whole catalogue 33 entries name it. The counts are small, so read them as a rough order, not a rate.

CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.

How MITRE says to find it

From MITRE's CWE catalogue

  • Automated Static Analysis
  • Automated Dynamic Analysis
  • Manual Analysis
  • Automated Static Analysis - Binary or Bytecode
  • Dynamic Analysis with Automated Results Interpretation

What MITRE suggests

From MITRE's CWE catalogue

These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.

  • Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
  • Architecture and Design: If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
  • Architecture and Design: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task.
  • Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602.

Attack patterns MITRE links to it

From MITRE's CWE catalogue

Our notes that name it

From our own notes

Start with one piece of work.

Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.

Talk to us