UBUNTU-CVE-2026-126673: Code Injection
Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in dumpqr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Data::Dump::Streamerto a version that resolves this vulnerability.Fixed in 3.00
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications are exposed if they accept attacker-controlled regular-expression patterns, compile those patterns, serialize them with Data::Dump::Streamer, and later restore the dump using eval or do. Merely using the package without that compile-dump-restore workflow is not described as exploitable.
What does an attacker need to exploit this issue?
The attacker needs to supply a regular-expression pattern that reaches _dump_qr and is later evaluated from the generated dump. Patterns containing constructs such as "@{[ ... ]}" or "${\ ... }" can cause arbitrary Perl code to run during restoration.
What can be done if upgrading is not immediately possible?
Do not evaluate Data::Dump::Streamer output with eval or do when it may contain regular expressions derived from untrusted input. Prevent untrusted users from supplying patterns that are compiled and subsequently dumped for restoration.
How can I determine whether an installation is affected?
The issue affects Data::Dump::Streamer versions before 3.00. Review whether the installed package version is below 3.00 and whether the application restores generated dumps through eval or do.