CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.
The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a qr'...' literal and compiled as source text, so a (?{ ... }) code block in it runs without use re 'eval'. Single quotes in the pattern are escaped, but a code block runs in place and needs none.
An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JQ::Liteto a version that resolves this vulnerability.Fixed in 2.51
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using JQ::Lite before 2.51 are exposed if an attacker can supply a query or can control text that the application inserts into a regular-expression pattern within a query.
What access does an attacker need to execute code?
The attacker needs control over a pattern used by test(), match(), or the match or =~ conditions of select(). A (?{ ... }) block in that pattern can execute arbitrary Perl code in the calling process.
Are escaped single quotes sufficient to prevent exploitation?
No. Although single quotes in the pattern are escaped, an attacker can place a Perl code block directly in the regular expression and does not need quotes.
What version addresses the issue?
Version 2.51 addresses the issue; versions before 2.51 are affected.