# CVE-2026-14380: Perl DBI code injection in Profile attribute

Source: https://junglewise.ai/threats/cve-2026-14380-perl-dbi-code-injection-in-profile-attribute  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-14380 · Severity: info · CVSS 9.8 · Published 2026-07-07

The Perl DBI library, a standard database interface for the Perl programming language, contains a vulnerability that allows for arbitrary code execution. By providing a specially crafted database connection string or setting specific environment variables, an attacker can execute unauthorized commands on the host system. This could lead to a complete system takeover, data theft, or service disruption, particularly in environments where database connection parameters are influenced by user input.

Technologies: [Perl DBI Team DBI](https://junglewise.ai/threats/technologies/dbi). Vendors: [Perl DBI Team](https://junglewise.ai/threats/vendors/perl-dbi-team).

## Quick answers

**Is CVE-2026-14380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14380 being exploited in the wild.

**How severe is CVE-2026-14380?** Informational severity, with a CVSS score of 9.8, published 7 July 2026.

**Which products and versions are affected?** Perl DBI Team DBI < 1.650.

**Is there a fix for CVE-2026-14380?** A patch was published on 2026-07-06: Version 1.650 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14380 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-14380?** Check whether you run Perl DBI Team DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in DBI's profiling mechanism (DBI::Profile). When a string is assigned to a DBI handle's 'Profile' attribute, the library splits the string and interpolates the package portion into a 'string eval' statement without prior validation. This occurs in DBI/Profile.pm within the _auto_new function. An attacker can trigger this by controlling the DBI_PROFILE environment variable, a direct $dbh->{Profile} assignment, or more critically, via the 'Profile' parameter in a DSN connection string (e.g., dbi:Driver(Profile=>...):db). In networked environments using DBI::Gofer or DBI::ProxyServer, this allows a remote client to execute arbitrary Perl code on the broker host. The issue is fixed in version 1.650 by using Module::Load to handle package loading securely.

## Affected products

- Perl DBI Team DBI < 1.650

## Timeline

- 2026-07-06: patched: Version 1.650 released with fix.
- 2026-07-07: advisory: GHSA-ch8w-hxc2-v557 published.
- 2026-07-07: disclosed: CVE-2026-14380 published.

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch](https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch)
- [https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557)
- [https://metacpan.org/release/HMBRAND/DBI-1.650/changes](https://metacpan.org/release/HMBRAND/DBI-1.650/changes)

## Related threats

- [Perl DBI memory exhaustion in DBI::ProfileData parser](https://junglewise.ai/threats/cve-2026-60081-perl-dbi-memory-exhaustion-in-dbi-profiledata-parser)
- [Perl DBI stack buffer overflow in error handling](https://junglewise.ai/threats/cve-2026-9698-perl-dbi-stack-buffer-overflow-in-error-handling)
- [Perl DBI heap overflow in preparse SQL statement expansion](https://junglewise.ai/threats/cve-2026-10879-perl-dbi-heap-overflow-in-preparse-sql-statement-expansion)