CVE-2026-126673: Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr

Published Nov 12, 2026

Updated

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in dumpqr.

A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.

An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Data::Dump::Streamer to a version that resolves this vulnerability.
Fixed in 3.00

Event History

Nov 12, 2026

CVE Published

via MITRE·12:44 AM

Data Sourced

via MITRE·12:44 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:17 AM

DescriptionWeakness

Frequently Asked Questions

Which applications are realistically exposed?

Applications using Data::Dump::Streamer before 3.00 are exposed only if they process an attacker-supplied regular-expression pattern, serialize it with _dump_qr, and later restore or evaluate the dump with Perl eval or do. The issue can result in arbitrary Perl code execution in that workflow.

What input is required to exploit the issue?

An attacker needs to supply a Regexp pattern that the application compiles, dumps, and later evaluates. Patterns containing "@{[ ... ]}" or "${\ ... }" can execute code during evaluation; a delimiter that was already escaped can also be used to terminate the qr literal early.

Are default installations affected?

The provided information does not establish whether a default application configuration performs the required dump-and-evaluate workflow. Mere installation of an affected version is not sufficient; the application must evaluate or load a dump containing an attacker-influenced Regexp.

What can be done before upgrading?

Do not pass attacker-controlled Regexp patterns through Data::Dump::Streamer and then evaluate the resulting dump with eval or do. Avoid evaluating serialized dumps that may contain untrusted or attacker-influenced regular expressions.

CVE-2026-126673: Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr

Remediation

Event History

Frequently Asked Questions

Which applications are realistically exposed?

What input is required to exploit the issue?

Are default installations affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed?

What input is required to exploit the issue?

Are default installations affected?

What can be done before upgrading?