JQ::Lite, a Perl module used for manipulating JSON-like structures, allows evaluation of Perl code embedded in a regular expression pattern before version 2.51. A pattern containing a code block such as (?{ ... }) is compiled via string eval inside the module, meaning that any Perl code placed in that block is executed in the context of the calling process. An attacker who supplies a crafted query, or whose input becomes part of a query pattern, can trigger arbitrary Perl code execution. The impact is a full compromise of the host environment, granting attackers full control over the running application and potentially the underlying operating system.

Perl applications that use JQ::Lite versions prior to 2.51 are affected. The vulnerability applies to all distribution channels that ship this older module, including CPAN releases and any custom deployments that have not updated to 2.51 or later.

The vulnerability is severe; the CVSS score is not provided, but the nature of arbitrary code execution indicates a high severity rating. EPSS data is unavailable, and the issue is not yet listed in CISA’s KEV catalog. The attack vector is inferred to involve supplied queries or input that becomes part of a pattern, so an application that processes user data through JQ::Lite without sanitization could be exploited remotely. Because the module compiles the pattern directly, no complex prerequisites exist beyond supplying a query containing executable code.