CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

As cited

Copy frozen at 2026-10-19 18:15 UTC (site build).

vulnerabilities

CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

CVE-2026-78497 affects JQ::Lite for Perl versions before 2.51, which execute arbitrary Perl code embedded in query regular expressions through unsafe string evaluation. The vulnerability allows code injection during query compilation. Updates to version 2.51 and later address the flaw.

Why it matters: Perl developers using JQ::Lite should upgrade immediately if they process untrusted query input, as the vulnerability enables remote code execution on systems running vulnerable versions.

Source published

2026-10-18 15:35 UTC

First seen by Cybersecurity Tracker

2026-10-19 17:05 UTC