Module::Load versions prior to 0.22 allow loading of modules located outside of the normal @INC directories when a module name is prefixed with a double colon. An attacker who can influence the value passed to load can cause that module to be loaded, resulting in the execution of arbitrary code. The flaw is a classic instance of CWE‑145, with a CVSS score of 9.8 indicating a high threat.

The vulnerable component is the BINGOS Module::Load library. All releases before 0.22, including those bundled with Perl 5.15.3 and earlier, are affected. Perl distributions after version 5.15.4 ship with the corrected Module::Load implementation and are not vulnerable.

The high CVSS score signifies significant risk, while the EPSS score of less than 1% indicates a very low chance of exploitation. The vulnerability is not in the CISA KEV catalog, suggesting no widespread exploitation has been observed. Exploitation requires an attacker to control the module name supplied to load, which occurs when the application accepts untrusted input. Based on the description, it is inferred that applications that directly pass user-supplied values to load without validation are at risk.