https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 10:42:39 +0000 https://db.gcve.eu/vuln/cve-2026-126673 <p><strong>Affected:</strong> Data-Dump-Streamer</p> <p>Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.</p> <p>A Regexp&#39;s pattern is written into a qr literal without escaping &#34;$&#34; or &#34;@&#34;, so &#34;@{[ ... ]}&#34; and &#34;${\ ... }&#34; in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.</p> <p>An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.</p> <p><strong>Affected:</strong> Data-Dump-Streamer</p> <p>Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.</p> <p>A Regexp&#39;s pattern is written into a qr literal without escaping &#34;$&#34; or &#34;@&#34;, so &#34;@{[ ... ]}&#34; and &#34;${\ ... }&#34; in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.</p> <p>An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.</p> https://db.gcve.eu/vuln/cve-2026-126673