CVE-2026-126673: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-126673 is a code injection vulnerability in the Perl module Data::Dump::Streamer affecting all versions before 3.00. The flaw resides in the _dump_qr function, which serializes Regexp objects into qr literals without properly escaping $ or @ characters, enabling embedded Perl code to execute when the dump is later evaluated. It was published on November 12, 2026, and assigned a HIGH severity estimate by Feedly; no official CVSS score has been published at this time. The vulnerability was assigned by CPANSec and is tracked under GHSA-h6p6-jc3j-2qf8 (GitHub Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). The _dump_qr function in Data::Dump::Streamer writes a Regexp's pattern directly into a qr/.../ literal without escaping the $ and @ sigils, which are interpolated as code in Perl string contexts. As a result, patterns containing constructs like @{[ system('cmd') ]} or ${\ ...} will execute arbitrary Perl code when the serialized dump is later processed via eval or do. A secondary issue compounds the problem: an already-escaped delimiter receives a second backslash, causing the delimiter to appear unescaped and terminating the qr literal prematurely, which can further corrupt or manipulate the evaluated code structure (GitHub Advisory, oss-sec).

An attacker who can supply a crafted regular expression pattern to an application that compiles it, serializes it with Data::Dump::Streamer, and later restores it via eval or do can execute arbitrary Perl code with the privileges of the application process. This enables full compromise of the affected application, including unauthorized data access, data manipulation, and potential lateral movement within the hosting environment. The impact is most severe in applications that use Data::Dump::Streamer as part of a data persistence or caching pipeline that accepts user-controlled input (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific application architecture where attacker-controlled regex patterns are serialized and later evaluated, limiting the attack surface to a subset of applications using this module.

1. Identify a target application: Find a Perl application that uses Data::Dump::Streamer (version < 3.00) to serialize Regexp objects and later restores them using eval or do — for example, a caching layer or configuration serializer that accepts user-supplied patterns.
2. Craft a malicious Regexp pattern: Construct a regular expression containing an embedded Perl code execution payload, such as (?:@{[system('id')]}) or (?:${\scalar(system('id'))}), which will be interpolated as code during evaluation.
3. Supply the pattern to the application: Submit the crafted pattern through whatever input vector the application exposes (e.g., a web form, API parameter, or file upload) that causes the application to compile it into a Regexp object.
4. Trigger serialization: Cause the application to serialize the Regexp using Data::Dump::Streamer's dump functionality, which writes the unescaped pattern into a qr literal in the output.
5. Trigger evaluation: Cause the application to restore the serialized data via eval or do, at which point the embedded payload executes as Perl code with the application's privileges (GitHub Advisory, oss-sec).

Upgrade Data::Dump::Streamer to version 3.00 or later, which fixes the escaping of $ and @ characters in _dump_qr (GitHub Advisory, MetaCPAN Changelog). As a workaround where upgrading is not immediately possible, avoid passing user-controlled input as Regexp patterns in applications that serialize and later eval/do the output. Additionally, audit any code paths that use Data::Dump::Streamer to serialize data subsequently restored via eval or do, and consider replacing eval/do-based deserialization with a safer alternative such as Storable or JSON.

The vulnerability was disclosed via the oss-security mailing list on November 12, 2026, and received automated coverage from vulnerability aggregators (oss-sec). Social media posts on Bluesky and Mastodon/infosec.exchange noted the disclosure, but no significant researcher commentary or vendor statements beyond the patch release have been observed.