# CVE-2026-78497: JQ::Lite Perl code execution via regex eval

Source: https://junglewise.ai/threats/cve-2026-78497-jq-lite-versions-before-2-51-for-perl-execute-perl-code-embedded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-78497 · Severity: info · Published 2026-10-18

JQ::Lite is a Perl module for querying and transforming data structures. Versions before 2.51 unsafely compile regular expression patterns using string eval, allowing attackers to execute arbitrary Perl code by embedding it in a regex code block. This can lead to full system compromise if the application processes untrusted query patterns.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-78497 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78497 being exploited in the wild.

**How severe is CVE-2026-78497?** Informational severity, published 18 October 2026.

**Which products and versions are affected?** CPAN JQ::Lite before 2.51.

**Is there a fix for CVE-2026-78497?** Yes: fixed in 2.51. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78497 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78497?** Check whether you run CPAN JQ::Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.51

## Technical details

The vulnerability exists in JQ::Lite's regex compilation logic, which constructs patterns as qr'...' string literals and evaluates them with eval(), bypassing the requirement for 'use re "eval"'. An attacker can inject (?{ ... }) code blocks into patterns passed to test(), match(), or select() conditions to achieve arbitrary code execution. The fix replaces string eval with a safer qr/(?$modifiers:$pattern)/ approach.

## Affected products

- CPAN JQ::Lite before 2.51

## Timeline

- 2026-10-18: disclosed
- 2026-09-12: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/kawamurashingo/JQ-Lite/commit/c461721ae3d5a90d6d94dbb234c1b8dfee5c1769.patch](https://github.com/kawamurashingo/JQ-Lite/commit/c461721ae3d5a90d6d94dbb234c1b8dfee5c1769.patch)