CVE-2026-126673
2026-11-12
00h44 +00:00
00h44 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr
Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.CVE 解決方案
Upgrade to Data-Dump-Streamer 3.00 or later.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Improper Control of Generation of Code The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
