Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr
Summary
| CVE | CVE-2026-126673 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-12 01:17:11 UTC |
| Updated | 2026-11-12 06:17:14 UTC |
| Description | Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code. |
Risk And Classification
Problem Types: CWE-94 | CWE-94 CWE-94 Improper Control of Generation of Code
There are no known software configurations currently associated with this CVE in NVD or the CVE Program record.
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.openwall.com/lists/oss-security/2026/11/12/2 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Upgrade to Data-Dump-Streamer 3.00 or later.
Workarounds
CNA: For deployments that cannot upgrade to 3.00, which requires Perl 5.18 and a C compiler, do not restore dumps that contain Regexps compiled from untrusted input.
There are currently no legacy QID mappings associated with this CVE.