Every CVE Search/ Get API key

CVE-2021-36770

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a...

7.8 HighFix available

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.39%Up 0.7 points since Aug 12, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
CVE-2021-36770
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-427
Updated
2026-11-02
CVE List No score

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
CVE-2021-36770
Updated
2026-11-02
EUVDEUVD-2021-23358 No score

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
EUVD-2021-23358
Updated
2026-11-02
GitHub AdvisoriesGHSA-3gfh-9hwx-r3vr 7.8

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a...

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
GHSA-3gfh-9hwx-r3vr
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-426, CWE-427
Updated
2026-11-02
OSVALPINE-CVE-2021-36770 7.8

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
ALPINE-CVE-2021-36770
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-36770 7.8

CVE-2021-36770 does not affect BellSoft software

Record
BELL-CVE-2021-36770
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV 7.8

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
CVE-2021-36770
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-36770 7.8

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
DEBIAN-CVE-2021-36770
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1549 7.8

perl-Encode security update

Character encodings in Perl.

Security Fix(es):

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.(CVE-2021-36770)

Record
OESA-2022-1549
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-36770 7.8

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
UBUNTU-CVE-2021-36770
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2021-0527 No score

Updated perl/perl-Encode packages fix security vulnerability

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Record
MGASA-2021-0527
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perl
Alpine:v3.15
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.16
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.17
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.18
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.19
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.20
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.21
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.22
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.23
 before 5.34.0-r1
5.34.0-r1
perl
Alpine:v3.24
 before 5.34.0-r1
5.34.0-r1
Show 28 moreShow less
Affected packages
PackageAffectedFixed
perl-encode
Alpine:v3.15
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.16
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.17
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.18
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.19
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.20
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.21
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.22
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.23
 before 3.12-r0
3.12-r0
perl-encode
Alpine:v3.24
 before 3.12-r0
3.12-r0
libencode-perl
Debian:12
 before 3.08-2
3.08-2
libencode-perl
Debian:13
 before 3.08-2
3.08-2
libencode-perl
Debian:14
 before 3.08-2
3.08-2
perl
Debian:12
 before 5.32.1-5
5.32.1-5
perl
Debian:13
 before 5.32.1-5
5.32.1-5
perl
Debian:14
 before 5.32.1-5
5.32.1-5
perl
Mageia:8
 before 5.32.1-1.1.mga8
5.32.1-1.1.mga8
perl-Encode
Mageia:8
 before 3.80.0-1.1.mga8
3.80.0-1.1.mga8
perl-Encode
openEuler:20.03-LTS-SP1
 before 3.06-2.oe1
3.06-2.oe1
perl-Encode
openEuler:20.03-LTS-SP2
 before 3.06-2.oe1
3.06-2.oe1
perl-Encode
openEuler:20.03-LTS-SP3
 before 3.06-2.oe1
3.06-2.oe1
libencode-perl
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.76-12.78-12.78-1build12.79-12.82-1
 None known
libencode-perl
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.08-23.16-13.16-1build1
 None known
perl
Ubuntu:22.04:LTS
 before 5.32.1-3ubuntu3
5.32.1-3ubuntu3
libencode-perl
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.19-1build13.20-13.20-1build13.21-13.21-1build13.21-1build2
 None known
libencode-perl
Ubuntu:25.10
 All versions, plus listed versions
3.21-1build3
 None known
libencode-perl
Ubuntu:26.10
 All versions, plus listed versions
3.21-1build33.24-13.24-1build1
 None known
libencode-perl
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.21-1build3
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-36770 is a high vulnerability (CVSS 7.8) in Fedoraproject Fedora, published August 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in perl 5.34.0-r1.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open