DataDog::DogStatsd Perl modules through version 0.07 fail to sanitise input tags used in the event method, permitting the injection of arbitrary metric names, values, and control characters. The flaw manifests as a path injection (CWE‑150) and invalid escape sequence exploitation (CWE‑93). An attacker can corrupt metrics and distort monitoring dashboards, but the available data does not indicate a denial‑of‑service capability.

All installations of the DataDog::DogStatsd Perl client whose version is 0.07 or earlier are affected. Any environment that uses the event API to accept tags from external or untrusted sources poses a risk.

The vulnerability is exercised via the event method; an attacker who can supply event tags—through application integration or a network interface feeding tags to DogStatsd—can trigger malicious metric injection. No CVSS score is provided, the EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector is inferred to be any interface that forwards tags to the DogStatsd client.