Arbitrary Code Execution Vulnerability in JQ::Lite for Perl
CVE-2026-78497

Currently unrated

Key Information:

Status
Vendor
CVE Published:
18 October 2026

What is CVE-2026-78497?

JQ::Lite versions before 2.51 for Perl are vulnerable to arbitrary code execution, allowing attackers to execute Perl code embedded within a query's regular expression. The vulnerability arises from the compilation of patterns that allows the use of code blocks without required safety checks. An attacker can manipulate input to insert malicious code, leading to potential exploitation within the affected application.

References

https://github.com/kawamurashingo/JQ-Lite/commit/c461721a...
patch
https://metacpan.org/release/SHINGO/JQ-Lite-2.51/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.