A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.
An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Data-Dump-Streamer 3.00 or later.
Vendor Workaround
For deployments that cannot upgrade to 3.00, which requires Perl 5.18 and a C compiler, do not restore dumps that contain Regexps compiled from untrusted input.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 12 Nov 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code. | |
| Title | Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr | |
| Weaknesses | CWE-94 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-12T00:44:34.065Z
Reserved: 2026-11-11T12:57:30.656Z
Link: CVE-2026-126673
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-12T01:17:11.457
Modified: 2026-11-12T01:17:11.457
Link: CVE-2026-126673
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-94
Improper Control of Generation of Code ('Code Injection')