Live › vulnerability › CVE-2026-78497
Go to dashboardJQ::Lite before 2.51 compiles the regular expression in a query as Perl source with string eval, so a (?{ ... }) code block inside the pattern runs. An attacker who can supply a query, or text placed into a query pattern, executes arbitrary Perl code in the calling process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that run JQ::Lite queries where the query text or pattern comes from users or external data are exposed, because the regex can carry code that runs in the calling Perl process. Applications that only run fixed, developer-written queries with no user input in them are much less exposed. Teams not using JQ::Lite can skip this.
No product ranges from the sources yet.
perl -MJQ::Lite -e 'print $JQ::Lite::VERSION' or cpanm --info JQ::Litetest(, match( or select( with user-controlled query strings2.51 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.
The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a qr'...' literal and compiled as source text, so a (?{ ... }) code block in it runs without use re 'eval'. Single quotes in the pattern are escaped, but a code block runs in place and needs none.
An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
This page as .md · .json · in your agent: get_signal("CVE-2026-78497")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.