Cyber ·
CVE-2026-126673: code injection in Data::Dump::Streamer for Perl before 3.00
CPAN Security Group advisory describes code injection through unescaped Regexp patterns in _dump_qr, in Data::Dump::Streamer versions earlier than 3.00.
The CPAN Security Group registered CVE-2026-128673 style identifier CVE-2026-126673 for Data::Dump::Streamer, a Perl module in the Data-Dump-Streamer distribution. According to the advisory, versions earlier than 3.00 allow code injection because unescaped Regexp patterns are processed in the _dump_qr function. The text was posted to the oss-sec list on November 11 and appeared in the feed dated November 12, 2026. The material received is an automatic translation, so technical details should be checked in the original advisory, which also points to the package page on MetaCPAN and the version control repository. For anyone depending on the module, the practical point is to identify the installed version and assess upgrading to 3.00 or later. This is a software flaw in a third-party library and does not depend on the organization using AI.