CVE-2026-126673 · Package
NO FIX YET · SEE WHAT TO DO
Data::Dump::Streamer before 3.00 writes Regexp patterns into a qr literal without escaping "$" and "@", so embedded expressions run as Perl code. An attacker who controls a pattern that an application dumps and later restores with eval or do can execute arbitrary Perl code.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that use Data::Dump::Streamer to serialize Regexp objects built from untrusted input, and then restore that output with eval or do. Applications that only dump trusted patterns, or never evaluate the dump, are less exposed. The sources do not say whether a patched release beyond 3.00 is listed as the fix.
Not affected if dump-output-never-evaluated, no-untrusted-regexp-input
Who cares cpan, data-dump-streamer, perl
Data::Dump::Streamer in your Perl dependencies, for example with cpanm --info Data::Dump::Streamer or perl -MData::Dump::Streamer -e 'print $Data::Dump::Streamer::VERSION'eval or do3.00 or later (from the NVD description: versions before 3.00 are affected)Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.
A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.
An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.