Code Injection Vulnerability in Data::Dump::Streamer Perl Module
CVE-2026-126673

Currently unrated

Key Information:

Vendor

Perl

Status
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126673?

The Data::Dump::Streamer Perl module, specifically in versions prior to 3.00, is susceptible to a code injection vulnerability due to improper handling of unescaped regular expression patterns in the _dump_qr function. This flaw allows attackers to inject code through patterns containing special characters such as '$' and '@' that, when compounded with the module's behavior, can execute arbitrary Perl code. If an application compiles such a pattern and later restores it using eval or do, the injected code will run, potentially leading to severe security breaches.

References

https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.