CVE-2026-78497
8.4HighPublished 18 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-95
Impact
Attackers can execute arbitrary Perl code inside the host process if they control the query or input interpolated into regex patterns. They only need the ability to supply input that reaches test(), match(), or select() operations.
Root cause
JQ::Lite compiles regex patterns using string eval inside qr'...' literals without disabling embedded (?{ ... }) code execution blocks.
Affected systems
JQ::Lite before 2.51 for Perl
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade JQ::Lite to version 2.51 or later. If patching immediately is not possible, sanitize or reject inputs containing '(?{' before passing them into regex patterns.
$ cpanm JQ::Lite@2.51AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.