A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.
An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to Data-Dump-Streamer 3.00 or later.
Workaround
For deployments that cannot upgrade to 3.00, which requires Perl 5.18 and a C compiler, do not restore dumps that contain Regexps compiled from untrusted input.
Thu, 12 Nov 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 12 Nov 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code. | |
| Title | Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr | |
| Weaknesses | CWE-94 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-12T05:05:03.042Z
Reserved: 2026-11-11T12:57:30.656Z
Link: CVE-2026-126673
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-12T01:17:11.457
Modified: 2026-11-12T06:17:14.380
Link: CVE-2026-126673
Redhat
No data.
OpenCVE Enrichment
No data.