diff --git a/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch b/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch
new file mode 100644
index 0000000000..0bd7bbc967
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch
@@ -0,0 +1,79 @@
+From a1ce7931eda6262f0fe94a0b2cb25854f12d6be5 Mon Sep 17 00:00:00 2001
+From: Andi Albrecht <albrecht.andi@gmail.com>
+Date: Mon, 29 Jun 2026 08:29:32 +0200
+Subject: [PATCH] Escape backslashes in output formatters.
+
+(cherry picked from commit 53ff44b53e27cff78259acc1af015506fea60f63)
+
+CVE: CVE-2026-59894
+Upstream-Status: Backport [https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63]
+
+Dropped changes to the CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ sqlparse/filters/output.py | 16 ++++++++++------
+ tests/test_format.py       | 16 ++++++++++++++++
+ 2 files changed, 26 insertions(+), 6 deletions(-)
+
+diff --git a/sqlparse/filters/output.py b/sqlparse/filters/output.py
+index 253537e..697ebc3 100644
+--- a/sqlparse/filters/output.py
++++ b/sqlparse/filters/output.py
+@@ -61,9 +61,11 @@ class OutputPythonFilter(OutputFilter):
+                     yield sql.Token(T.Whitespace, after_lb)
+                 continue
+ 
+-            # Token has escape chars
+-            elif "'" in token.value:
+-                token.value = token.value.replace("'", "\\'")
++            # Escape backslashes before quotes so a backslash preceding a
++            # quote cannot break out of the generated string literal
++            # (GHSA-3496-9g83-7v6x).
++            else:
++                token.value = token.value.replace('\\', '\\\\').replace("'", "\\'")
+ 
+             # Put the token
+             yield sql.Token(T.Text, token.value)
+@@ -110,9 +112,11 @@ class OutputPHPFilter(OutputFilter):
+                     yield sql.Token(T.Whitespace, after_lb)
+                 continue
+ 
+-            # Token has escape chars
+-            elif '"' in token.value:
+-                token.value = token.value.replace('"', '\\"')
++            # Escape backslashes before quotes so a backslash preceding a
++            # quote cannot break out of the generated string literal
++            # (GHSA-3496-9g83-7v6x).
++            else:
++                token.value = token.value.replace('\\', '\\\\').replace('"', '\\"')
+ 
+             # Put the token
+             yield sql.Token(T.Text, token.value)
+diff --git a/tests/test_format.py b/tests/test_format.py
+index 0cdbcf8..9349506 100644
+--- a/tests/test_format.py
++++ b/tests/test_format.py
+@@ -689,6 +689,22 @@ class TestOutputFormat:
+             '$sql  = "select * ";',
+             '$sql .= "from foo;";'])
+ 
++    def test_python_escapes_backslashes(self):
++        # GHSA-3496-9g83-7v6x: backslashes must be escaped before quotes so
++        # crafted SQL cannot break out of the generated Python string literal.
++        # SQL  select '\foo\'  -> each \ doubled, each ' escaped.
++        sql = "select '\\foo\\'"
++        f = lambda sql: sqlparse.format(sql, output_format='python')
++        assert f(sql) == "sql = 'select \\'\\\\foo\\\\\\''"
++
++    def test_php_escapes_backslashes(self):
++        # GHSA-3496-9g83-7v6x: PHP double-quoted output must escape backslashes
++        # before quotes; a backslash before a quote otherwise closes the string.
++        # SQL  select '\foo\'  -> each \ doubled (single quotes need no escaping).
++        sql = "select '\\foo\\'"
++        f = lambda sql: sqlparse.format(sql, output_format='php')
++        assert f(sql) == '$sql = "select \'\\\\foo\\\\\'";'
++
+     def test_sql(self):
+         # "sql" is an allowed option but has no effect
+         sql = 'select * from foo;'
diff --git a/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb b/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb
index a1dc52db49..a23f5ec0e2 100644
--- a/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb
+++ b/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb
@@ -9,6 +9,7 @@ SRC_URI[sha256sum] = "e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa9
 SRC_URI += "file://CVE-2026-54284-1.patch \
             file://CVE-2026-54284-2.patch \
             file://CVE-2026-59893.patch \
+            file://CVE-2026-59894.patch \
 "
 
 CVE_PRODUCT = "sqlparse"