JQ::Lite before 2.51 executes Perl from query regexes (CVE-2026-78497)
Original title: CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
The Perl module compiles a query regular expression with string eval, running embedded Perl code.
Robert Rothenberg reported CVE-2026-78497 on oss-security on October 18. JQ::Lite for Perl before 2.51 executes Perl code embedded in a query's regular expression by compiling it with string eval. The visible post points to the JQ-Lite distribution on MetaCPAN and its VCS repository, then cuts off.
Unconfirmed: The snippet ends before any stated fix, exposure conditions, or exploitation status.
- Affected product is JQ::Lite for Perl before 2.51.
- Code runs because the regular expression is compiled with string eval.
- The report links to the MetaCPAN JQ-Lite distribution.
Impact: Perl code execution from a query regular expression
| Product | Affected |
|---|---|
| JQ::Lite | before 2.51 |
- 1.Upgrade JQ::Lite to 2.51 or later.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78497 | Perl code injection in JQ::Lite before 2.51 via regex | 8.4 | — |
From the original article
Posted by Robert Rothenberg on Oct 18 ======================================================================== https://metacpan. org/dist/JQ-Lite VCS Repo:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.