Is CVE-2026-14380 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14380 being exploited in the wild.

How severe is CVE-2026-14380?

Informational severity, with a CVSS score of 9.8, published 7 July 2026.

Is there a fix for CVE-2026-14380?

A patch was published on 2026-07-06: Version 1.650 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14380 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-14380?

Check whether you run Perl DBI Team DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14380: Perl DBI code injection in Profile attribute

CVE-2026-14380 · Severity: info · CVSS 9.8 · Published 2026-07-07

The Perl DBI library, a standard database interface for the Perl programming language, contains a vulnerability that allows for arbitrary code execution. By providing a specially crafted database connection string or setting specific environment variables, an attacker can execute unauthorized commands on the host system. This could lead to a complete system takeover, data theft, or service disruption, particularly in environments where database connection parameters are influenced by user input.

Technologies: Perl DBI Team DBI. Vendors: Perl DBI Team.

Quick answers

Is CVE-2026-14380 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14380 being exploited in the wild.
How severe is CVE-2026-14380?: Informational severity, with a CVSS score of 9.8, published 7 July 2026.
Which products and versions are affected?: Perl DBI Team DBI < 1.650.
Is there a fix for CVE-2026-14380?: A patch was published on 2026-07-06: Version 1.650 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14380 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-14380?: Check whether you run Perl DBI Team DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in DBI's profiling mechanism (DBI::Profile). When a string is assigned to a DBI handle's 'Profile' attribute, the library splits the string and interpolates the package portion into a 'string eval' statement without prior validation. This occurs in DBI/Profile.pm within the _auto_new function. An attacker can trigger this by controlling the DBI_PROFILE environment variable, a direct $dbh->{Profile} assignment, or more critically, via the 'Profile' parameter in a DSN connection string (e.g., dbi:Driver(Profile=>...):db). In networked environments using DBI::Gofer or DBI::ProxyServer, this allows a remote client to execute arbitrary Perl code on the broker host. The issue is fixed in version 1.650 by using Module::Load to handle package loading securely.

Affected products

Perl DBI Team DBI < 1.650

Timeline

2026-07-06: patched: Version 1.650 released with fix.
2026-07-07: advisory: GHSA-ch8w-hxc2-v557 published.
2026-07-07: disclosed: CVE-2026-14380 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.