Executive brief
Module::Load is a Perl library used by developers to dynamically load other software components (modules) into a running program. A vulnerability in versions before 0.22 allows an attacker to trick the library into loading and executing code from unintended locations on the system. If an application allows user-provided input to influence which module is loaded, an attacker could gain full control over the application's execution, potentially leading to data theft or system compromise.
Technical details
A vulnerability exists in Module::Load's '_to_file' routine where module names prefixed with '::' are not properly sanitized. This allows an attacker to bypass the intended @INC directory restrictions and specify arbitrary file paths. If an application passes untrusted user input to the 'load()' function, an attacker can achieve arbitrary code execution by forcing the application to load a malicious Perl module from a location of their choosing. The issue was addressed in version 0.22 by improving the validation of module names to prevent path traversal-like behavior.
Affected products
- BINGOS Module::Load before 0.22
Timeline
- 2011-10-02: disclosed: Public blog post discussing the security implications of module loading in Perl
- 2011-10-04: patched: Version 0.22 released to resolve the security problem
- 2026-07-07: advisory: CVE-2011-10043 published to NVD
References
- https://cpan.org/modules
- https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html
- https://metacpan.org/release/BINGOS/Module-Load-0.22/changes
- https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm