The vulnerability is a local code execution flaw caused by deserializing cached HTTP responses in the WWW::Mechanize::Cached Perl module. Cached responses are stored as frozen blobs and later recovered with Storable::thaw. If a non‑privileged attacker can write to the cache directory, they can replace a victim’s cached entry with a crafted blob. When the victim’s process retrieves the URL, Storable::thaw processes the malicious data, triggering any side‑effectful STORABLE_thaw, DESTROY, or overload hooks that may be defined by loaded classes. This chain can execute arbitrary code in the context of the victim process.

The affected product is WWW::Mechanize::Cached distributed by OALDERS. All releases prior to version 2.00 are vulnerable. These releases construct a default Cache::FileCache tree under /tmp/FileCache without enforcing a restrictive directory_umask, resulting in directories created with 0777 permissions. The absence of a sticky bit and the world‑writable nature of the cache allow any local user with write access to the directory to alter cache entries.

Because the flaw requires only local write access to the cache tree, the attack vector is a local attacker with file‑system privileges on the same host as the target process. The exploit is straightforward: inject a malicious frozen HTTP::Response and wait for the victim to request the URL. The EPSS score of 0.00051 indicates a low exploitation probability, and the vulnerability is not listed in KEV, but the inherent possibility of arbitrary code execution combined with the low barrier to attack portends a high risk. Administrators should treat this as an immediate threat until resolved, especially on systems where the default cache path is globally writable.