Most recent entries from all

fkie_cve-2026-126673

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.

A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.

An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.

GHSA-h6p6-jc3j-2qf8

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.

An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.

openSUSE-SU-2026:12549-1 — perl-Data-Dump-Streamer-3.1.0-1.1 on GA media

perl-Data-Dump-Streamer-3.1.0-1.1 on GA media

UBUNTU-CVE-2026-126673

Affected: Ubuntu:16.04:LTS: libdata-dump-streamer-perl, Ubuntu:18.04:LTS: libdata-dump-streamer-perl, Ubuntu:20.04:LTS: libdata-dump-streamer-perl, Ubuntu:22.04:LTS: libdata-dump-streamer-perl, Ubuntu:24.04:LTS: libdata-dump-streamer-perl, Ubuntu:26.10: libdata-dump-streamer-perl, Ubuntu:26.04:LTS: libdata-dump-streamer-perl

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.