========================================================================
CVE-2026-126673                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-126673

   Distribution:  Data-Dump-Streamer
       Versions:  before 3.00
       MetaCPAN:  https://metacpan.org/dist/Data-Dump-Streamer
       VCS Repo:  https://github.com/demerphq/Data-Dump-Streamer

Data::Dump::Streamer versions before 3.00 for Perl allow code injection
via unescaped Regexp patterns in _dump_qr

Description
-----------
Data::Dump::Streamer versions before 3.00 for Perl allow code injection
via unescaped Regexp patterns in _dump_qr.

A Regexp's pattern is written into a qr literal without escaping "$" or
"@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when
the dump is evaluated. An already escaped delimiter gets a second
backslash, which leaves the delimiter bare and ends the qr literal
early.

An attacker who supplies a pattern that an application compiles, dumps
and later restores with eval or do can run arbitrary Perl code.

Problem types
-------------
- CWE-94 Improper Control of Generation of Code

Workarounds
-----------
For deployments that cannot upgrade to 3.00, which requires Perl 5.18
and a C compiler, do not restore dumps that contain Regexps compiled
from untrusted input.

Solutions
---------
Upgrade to Data-Dump-Streamer 3.00 or later.

References
----------
https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes