The vulnerability resides in IO::Compress versions prior to 2.220, where the _parseOutputGlob method wraps an attacker‑controlled output glob string in double quotes and later evaluates it with eval. This quirk allows a crafted glob that contains a literal double quote to terminate the wrapper and inject arbitrary Perl code. The injected code runs with the permissions of the process that invoked IO::Compress, making this an arbitrary code execution flaw (CWE‑95).

Affected systems are Perl installations using the IO::Compress module from the PMQS vendor, specifically versions earlier than 2.220. The flaw is triggered whenever code calls IO::Compress's compression functions and supplies a glob pattern that can be controlled by an attacker or otherwise derived from user input.

The flaw carries a high risk due to the absence of effective mitigations beyond the patched module. EPSS data is not available, and the vulnerability is not yet listed in CISA KEV, but the capability to run arbitrary code gives the attacker full control over the host. Likely attack vectors involve a Perl script that processes user input and passes it to IO::Compress; if an attacker can influence the output glob, they can execute any Perl code. The severity can be expected to be high, and the vulnerability is practical for exploitation in environments where untrusted input reaches IO::Compress.