CVE-2009-2946
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote...
CVE-2009-2946 is a high vulnerability (CVSS 9.3) in Devscripts Devel Team Devscripts, published September 2, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in devscripts 2.10.54.
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
Exploit likelihood
What each source reports
NVD Score used
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
CVE-2009-2946- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
CVE-2009-2946- Updated
- 2026-11-02
EUVDEUVD-2009-2933 No score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
EUVD-2009-2933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9gf3-j9w5-g3hm No score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote...
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
GHSA-9gf3-j9w5-g3hm- Updated
- 2026-11-02
OSV No score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
CVE-2009-2946- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2946 No score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
DEBIAN-CVE-2009-2946- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
devscriptsDebian:12 |
before 2.10.54 | 2.10.54 |
devscriptsDebian:13 |
before 2.10.54 | 2.10.54 |
devscriptsDebian:14 |
before 2.10.54 | 2.10.54 |
devscriptsDebian:4.0 |
before 2.9.26etch4, plus listed versions 2.9.262.9.26etch12.9.26etch2 |
2.9.26etch4 |
devscriptsDebian:5.0 |
before 2.10.35lenny6, plus listed versions 2.10.35lenny22.10.35lenny32.10.35lenny6~bpo40+1 |
2.10.35lenny6 |
devscriptsDebian:4.0 |
before 2.9.26etch5, plus listed versions 2.9.262.9.26etch12.9.26etch22.9.26etch4 |
2.9.26etch5 |
devscriptsDebian:5.0 |
before 2.10.35lenny7, plus listed versions 2.10.35lenny22.10.35lenny32.10.35lenny62.10.35lenny6~bpo40+12.10.35lenny7~bpo40+1 |
2.10.35lenny7 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
svn.debian.org/wsvn/devscripts/trunk/scripts/uscan.pl?op=diff&rev=1984&sc=1
bugs.debian.org/cgi-bin/bugreport.cgi?bug=515209
debian.org/security/2009/dsa-1878
nvd.nist.gov/vuln/detail/CVE-2009-2946
github.com/advisories/GHSA-9gf3-j9w5-g3hm
security-tracker.debian.org/tracker/CVE-2009-2946