{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"Data-Dump-Streamer","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"3.00","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-126673","cwes":["CWE-94"],"description":"Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.\n\nA Regexp's pattern is written into a qr literal without escaping \"$\" or \"@\", so \"@{[ ... ]}\" and \"${\\ ... }\" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.\n\nAn attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794444274065,"publishedAt":1794444274065,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to Data-Dump-Streamer 3.00 or later."},{"kind":"workaround","source":"CNA: CPANSec","text":"For deployments that cannot upgrade to 3.00, which requires Perl 5.18 and a C compiler, do not restore dumps that contain Regexps compiled from untrusted input."}],"revision":"250f2241ba2ce3c1a59a2ea9629a3370d1cde8a0becb34610366c04322f6946b","sources":[{"modifiedAt":1794444274065,"name":"CNA: CPANSec","retrievedAt":1794445706310,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126673"}],"ssvc":null,"status":"published","title":"Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr","updatedAt":1794445706310}