Plack::Middleware::Session::Cookie until version 0.21 deserializes cookie data without verifying a secret. This flaw permits an attacker to embed malicious code in a cookie that, when processed by a legitimate application, causes the server to execute that code. The result is remote code execution, granting the attacker full control over the affected host.

The Perl module MIYAGAWA::Plack::Middleware::Session::Cookie, versions 0.21 and earlier. End users running these versions on any platform that accepts HTTP cookies are vulnerable. The official fix is to upgrade to version 0.23 or later and configure the required 'secret' parameter; alternatively, simply setting a secret protects existing installations.

With a CVSS base score of 9.8 the flaw is considered critical. EPSS indicates the exploitation likelihood is currently below 1 %, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, the remote nature of the attack and the ability to trigger code execution via a crafted cookie make the risk high for exposed web applications. Attackers can deliver the cookie in HTTP requests to any vulnerable endpoint, assuming the application uses the module for session handling.