CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
Perl DBI before 1.653 loads arbitrary modules via unvalidated DBD::DBM dbm_type and dbm_mldbm attributes, enabling code execution with attacker-controlled attributes.
CVE-2026-78030 affects the Perl DBI database interface in all versions before 1.653. The DBD::DBM driver does not validate the dbm_type and dbm_mldbm attributes before using them to load Perl modules, so applications that pass attacker-controlled attributes to DBI connect can be made to load arbitrary modules, which can lead to code execution. Robert Rothenberg disclosed the flaw on the oss-security mailing list on September 19, 2026; users should upgrade to DBI 1.653.
52