CVE-2026-14380

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the execution of unauthorized Perl code, including system commands. An attacker with control over certain inputs, such as environment variables or connection string parameters, could exploit this to achieve arbitrary code execution on the affected system. In some configurations, this could lead to remote code execution.

This Important vulnerability in the Perl DBI component allows for arbitrary code execution due to improper validation of the Profile attribute. An attacker can exploit this by controlling inputs such as the DBI_PROFILE environment variable or DSN parameters, leading to the execution of unauthorized Perl code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk of arbitrary code execution, avoid setting the DBI_PROFILE environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with dbi:Driver(Profile=>SPEC):db, are not populated with unvalidated or untrusted input.