High 8.8Published Jul 7, 2026

CVE-2026-14380DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.

Updated under an hour ago (2026-10-19 09:50 UTC)

Does this affect you?

It affects perl dbi. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for perl dbi

Exploited in the last 30 days

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands. The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.

CVSS: 8.8 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-95, CWE-470
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Aug 31, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

perl dbi perl:dbi	before 1.650	NVD

References

https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patchpatch
https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557vendor-advisory
https://metacpan.org/release/HMBRAND/DBI-1.650/changesrelease-notes
http://www.openwall.com/lists/oss-security/2026/07/07/16mailing-list, patch, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.