{"id":"CVE-2026-78497","aliases":["EUVD-2026-103450"],"status":"published","title":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval","description":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00196,"percentile":0.09425,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-95"],"published":"2026-10-18T11:32:05Z","modified":"2026-10-28T02:31:14Z","references":[{"url":"https://github.com/kawamurashingo/JQ-Lite/commit/c461721ae3d5a90d6d94dbb234c1b8dfee5c1769.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/SHINGO/JQ-Lite-2.51/changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/18/3","tags":["web"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78497.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78497","tags":["advisory"]},{"url":"https://github.com/kawamurashingo/JQ-Lite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-78497","title":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval","description":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","status":"published","published":"2026-10-18T11:32:05.853Z","modified":"2026-10-20T18:22:12.298Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T13:34:59.78118Z"}],"euvd":[{"id":"EUVD-2026-103450","description":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","status":"published","published":"2026-10-18T11:32:05Z","modified":"2026-10-20T18:22:12Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:43.145678Z"}],"nvd":[{"id":"CVE-2026-78497","description":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","status":"published","published":"2026-10-18T12:17:15.35Z","modified":"2026-10-20T19:18:15.957Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-78497","title":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval","description":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","status":"published","published":"2026-10-18T11:32:05.853Z","modified":"2026-10-28T02:31:14.97704572Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T15:45:17.44708Z"}]}}