DEBIAN-CVE-2026-126673: Code Injection
Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in dumpqr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Data::Dump::Streamerto a version that resolves this vulnerability.Fixed in 3.00
Event History
Frequently Asked Questions
What application workflow is exposed to this issue?
The vulnerable workflow is one that accepts an attacker-controlled regular-expression pattern, compiles it, serializes it with Data::Dump::Streamer, and later restores the dump using eval or do. The code execution occurs when the generated dump is evaluated.
What input does an attacker need to exploit it?
An attacker needs control of a Regexp pattern that reaches the _dump_qr serialization path and is subsequently evaluated from the generated dump. Patterns containing constructs such as "@{[ ... ]}" or "${\ ... }" can cause Perl code to run during restoration.
Are applications that only dump regular expressions affected?
The provided information identifies execution when the dump is evaluated with eval or do. An application that does not later evaluate or load the generated dump through those mechanisms is not described as reaching the code-execution condition.
What can be done if upgrading is not immediately possible?
Do not serialize attacker-controlled Regexp objects with the affected component, and do not restore generated dumps using eval or do when they may contain untrusted patterns. Treat existing serialized data containing untrusted regular-expression patterns as unsafe to evaluate.