---
id: "CVE-2026-78497"
kind: "vulnerability"
aliases: ["CVE-2026-78497"]
title: "JQ::Lite for Perl: query regex lets attackers run embedded Perl code"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cpan", "jq-lite", "package", "perl"]
not_affected_if: ["fixed-queries-only", "jq-lite-not-used"]
published_at: "2026-10-18T12:17:15+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:01:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78497", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# JQ::Lite for Perl: query regex lets attackers run embedded Perl code

JQ::Lite before 2.51 compiles the regular expression in a query as Perl source with string eval, so a (?{ ... }) code block inside the pattern runs. An attacker who can supply a query, or text placed into a query pattern, executes arbitrary Perl code in the calling process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JQ::Lite version with `perl -MJQ::Lite -e 'print $JQ::Lite::VERSION'` or `cpanm --info JQ::Lite`
- Search the codebase for calls to `test(`, `match(` or `select(` with user-controlled query strings

## Fix

- Upgrade JQ::Lite to `2.51` or later
- Do not build query patterns from untrusted input until upgraded

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78497

## From the sources

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.

The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.

An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_