DBI::SQL::Nano, the miniature SQL engine bundled with Perl’s DBI module, contains a logic error in the is_matched method: when dealing with non‑numeric strings, the operator <= is implemented with Perl’s ge and >= with le, effectively inverting the comparison. The consequence is that any WHERE clause that relies on text comparisons returns the opposite set of rows, silently subverting policy or authorization checks that use such predicates.

Versions of HMBRAND's DBI::SQL::Nano module from 1.42 up to and including 1.650 are affected. These versions are used by file‑backed drivers such as DBD::File, DBD::DBM, and CSV‑style drivers whenever SQL::Statement is not present, and they are also forced into use when the environment variable DBI_SQL_NANO is set to 1.

The CVSS score of 9.8 indicates a critical vulnerability, while the EPSS score of < 1 % suggests low current exploitation activity; the issue is not listed in CISA’s KEV catalog. The likely attack surface is local or application‑level, requiring that an adversary be able to dictate a SQL query that includes a <= or >= comparison against a text field in a file‑backed database accessed through DBI. Based on the description, the attacker could manipulate the query to retrieve rows that should have been excluded, or otherwise bypass application‑level authorization checks that depend on text comparisons.