https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:37:09 +0000 https://vulnerability.circl.lu/vuln/cve-2026-14380 <p><strong>Affected:</strong> DBI</p> <p>DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.</p> <p>When a string is assigned to a DBI handle&#39;s Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.</p> <p>Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.</p> <p>The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=&gt;SPEC):db.</p> <p>An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.</p> <p><strong>Affected:</strong> DBI</p> <p>DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.</p> <p>When a string is assigned to a DBI handle&#39;s Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.</p> <p>Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.</p> <p>The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=&gt;SPEC):db.</p> <p>An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.</p> https://vulnerability.circl.lu/vuln/cve-2026-14380