CVE-2026-14380

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.650

Description Code injection is possible via a caller-influenced Profile attribute. When a string is assigned to this attribute, the software splits it into path, package, and arguments, then interpolates the package part in a string eval without validating the package name. This allows arbitrary Perl code execution, including system command calls, if an attacker controls the Profile attribute. This attribute can be influenced through the DBI PROFILE environment variable, direct attribute assignment, or a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. Network-exposed DBI::Gofer or DBI::ProxyServer instances are particularly susceptible if the per-request DSN reaches the Profile attribute, enabling remote code execution on the broker host.

Recommendations Update to version 1.650 or later.