{"id":"DEBIAN-CVE-2026-126673","details":"Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.  A Regexp's pattern is written into a qr literal without escaping \"$\" or \"@\", so \"@{[ ... ]}\" and \"${\\ ... }\" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.  An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.","modified":"2026-11-12T12:00:06.219916047Z","published":"2026-11-12T01:17:11.457Z","upstream":["CVE-2026-126673"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-126673"}],"affected":[{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Debian:12","purl":"pkg:deb/debian/libdata-dump-streamer-perl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-1","2.42-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Debian:13","purl":"pkg:deb/debian/libdata-dump-streamer-perl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Debian:14","purl":"pkg:deb/debian/libdata-dump-streamer-perl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126673.json"}}],"schema_version":"1.9.2"}