All errata/sisyphus/ALT-PU-2026-22077-2
ALT-PU-2026-22077-2

Package update perl-Data-Dump-Streamer in branch sisyphus

Version3.00-alt1
Published2026-11-14
Max severityNONE
Severity:

Closed issues (1)

CVE-2026-126673
NONE

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.

Published: 2026-11-11Modified: 2026-11-12