{"id":"CVE-2026-78497","revision":"fe232b68e2034cfe9f8c04362c5129a0","records":[{"revision":"fe232b68e2034cfe9f8c04362c5129a0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-78497","aliases":[],"title":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval","description":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","state":0,"publishedAt":"2026-10-18T11:32:05.853+00:00","modifiedAt":"2026-10-20T18:22:12.298+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"JQ-Lite","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"JQ::Lite\"\n                    ],\n                    \"packageName\": \"JQ-Lite\",\n                    \"packageURL\": \"pkg:cpan/JQ-Lite\",\n                    \"programFiles\": [\n                        \"lib/JQ/Lite/Util/Transform.pm\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"JQ::Lite::Util::_build_regex\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/kawamurashingo/JQ-Lite\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.51\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/kawamurashingo/JQ-Lite/commit/c461721ae3d5a90d6d94dbb234c1b8dfee5c1769.patch","https://metacpan.org/release/SHINGO/JQ-Lite-2.51/changes"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78497","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-78497","identifiers":["CVE-2026-78497"]},"retained":false,"historicalAffected":[]}],"coverage":[]}