GHSA-ch8w-hxc2-v557 on CTRL-OS 26.05

Aliases: GHSA-ch8w-hxc2-v557, CVE-2026-14380

Packages: perlPackages.DBI

Status: Plausible

Advisory Information

When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path/package/args and interpolates the package part straight into a string eval — eval "require $package" at DBI/Profile.pm:761 — with no validation of $package. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl execution (CWE-95). Unchanged on current master (1.649).

The Profile attribute is settable from three inputs that can carry untrusted data: the DBI_PROFILE environment variable, a direct $dbh->{Profile} = ... assignment, and — the widest surface — a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db, which DBI->connect parses (regex at DBI.pm:621, split into the attribute hash at DBI.pm:658) so SPEC lands in $attr->{Profile}. A DSN string reaching DBI->connect from user input reaches the eval.

An attacker controlling any of those inputs runs arbitrary Perl in the host process (full RCE). The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches _connect, escalating "SQL on the connected database" to "code execution on the broker host".

Fix: validate $package against a bare-package-name pattern (e.g. /\A[A-Za-z_]\w(?:::\w+)\z/) before the eval, or replace the string eval with a block-eval require of a computed module filename so no part of the spec is interpolated into Perl source. One-line change at Profile.pm:761.

Updates

2026-07-10 17:42 CEST

Metadata changes:

• Status for package perlPackages.DBI: “Plausible”

(Amended on: 2026-07-10 17:51 CEST)

2026-07-08 15:59 CEST

Metadata changes:

• Status for package perlPackages.DBI: “New”