{"id":"CVE-2026-78497","kind":"vulnerability","aliases":["CVE-2026-78497"],"related":[],"title":"JQ::Lite for Perl: query regex lets attackers run embedded Perl code","description":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","summary":"JQ::Lite before 2.51 compiles the regular expression in a query as Perl source with string eval, so a (?{ ... }) code block inside the pattern runs. An attacker who can supply a query, or text placed into a query pattern, executes arbitrary Perl code in the calling process.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpan","jq-lite","package","perl"],"not_affected_if":["fixed-queries-only","jq-lite-not-used"],"how_to_check":"- Check the installed JQ::Lite version with `perl -MJQ::Lite -e 'print $JQ::Lite::VERSION'` or `cpanm --info JQ::Lite`\n- Search the codebase for calls to `test(`, `match(` or `select(` with user-controlled query strings","fix":"- Upgrade JQ::Lite to `2.51` or later\n- Do not build query patterns from untrusted input until upgraded","status":"open","published_at":"2026-10-18T12:17:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:01:58+00:00","updated_at":"2026-10-25T03:01:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:01:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade JQ::Lite to `2.51` or later\n- Do not build query patterns from untrusted input until upgraded","reach":"unknown","title":"JQ::Lite for Perl: query regex lets attackers run embedded Perl code","impact":"high","summary":"JQ::Lite before 2.51 compiles the regular expression in a query as Perl source with string eval, so a (?{ ... }) code block inside the pattern runs. An attacker who can supply a query, or text placed into a query pattern, executes arbitrary Perl code in the calling process.","category":"package","nicknames":[],"who_cares":["perl","jq-lite","cpan"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary Perl code in the calling process","analyst_note":"Check the NVD entry and the JQ::Lite changelog for the exact fixed version and whether an unauthenticated remote path exists.","how_to_check":"- Check the installed JQ::Lite version with `perl -MJQ::Lite -e 'print $JQ::Lite::VERSION'` or `cpanm --info JQ::Lite`\n- Search the codebase for calls to `test(`, `match(` or `select(` with user-controlled query strings","needs_analyst":true,"not_affected_if":["fixed-queries-only","jq-lite-not-used"],"who_is_affected":"Applications that run JQ::Lite queries where the query text or pattern comes from users or external data are exposed, because the regex can carry code that runs in the calling Perl process. Applications that only run fixed, developer-written queries with no user input in them are much less exposed. Teams not using JQ::Lite can skip this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3417,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-78497':15A,18A '2.51':28B,76C 'applic':157C 'arbitrari':65B,166C 'attack':8A,51B,148C 'block':45B,122C,140C 'call':70B,171C 'code':12A,44B,67B,81C,121C,139C,168C 'compil':29B,90C,115C 'condit':105C 'cpan':19B 'cve':13A,16A 'embed':10A,82C 'escap':136C 'eval':41B,94C,129C 'execut':64B,79C,165C 'express':32B,88C 'given':97C 'insert':158C 'insid':46B 'jq':1A,21B,25B,72C 'jq-lite':20B 'let':7A 'lite':2A,22B,26B,73C 'liter':113C 'match':100C,103C 'need':145C 'none':146C 'one':163C 'packag':23B 'pattern':48B,63B,96C,134C,161C 'perl':4A,11A,24B,37B,66B,78C,80C,167C 'place':59B,109C,143C 'process':71B,172C 'qr':112C 'queri':5A,35B,56B,62B,85C,152C 'quot':131C 're':128C 'regex':6A 'regular':31B,87C 'run':9A,49B,125C,141C 'select':107C 'singl':130C 'sourc':38B,117C 'string':40B,93C 'suppli':54B,150C 'test':99C 'text':58B,118C,154C 'use':127C 'version':74C 'without':126C","nicknames":[],"mitigations":[],"who_affected":"Applications that run JQ::Lite queries where the query text or pattern comes from users or external data are exposed, because the regex can carry code that runs in the calling Perl process. Applications that only run fixed, developer-written queries with no user input in them are much less exposed. Teams not using JQ::Lite can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78497","severity":null,"published_at":"2026-10-18T12:17:15+00:00","modified_at":"2026-10-20T19:18:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}