Executive brief
The Perl DBI library, a standard database interface for the Perl programming language, contains a vulnerability that allows for arbitrary code execution. By providing a specially crafted database connection string or setting specific environment variables, an attacker can execute unauthorized commands on the host system. This could lead to a complete system takeover, data theft, or service disruption, particularly in environments where database connection parameters are influenced by user input.
Technical details
A code injection vulnerability exists in DBI's profiling mechanism (DBI::Profile). When a string is assigned to a DBI handle's 'Profile' attribute, the library splits the string and interpolates the package portion into a 'string eval' statement without prior validation. This occurs in DBI/Profile.pm within the _auto_new function. An attacker can trigger this by controlling the DBI_PROFILE environment variable, a direct $dbh->{Profile} assignment, or more critically, via the 'Profile' parameter in a DSN connection string (e.g., dbi:Driver(Profile=>...):db). In networked environments using DBI::Gofer or DBI::ProxyServer, this allows a remote client to execute arbitrary Perl code on the broker host. The issue is fixed in version 1.650 by using Module::Load to handle package loading securely.
Affected products
- Perl DBI Team DBI < 1.650
Timeline
- 2026-07-06: patched: Version 1.650 released with fix.
- 2026-07-07: advisory: GHSA-ch8w-hxc2-v557 published.
- 2026-07-07: disclosed: CVE-2026-14380 published.