CVE-2026-78497

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.

Not reported by tracked sources.

Track

Current priority score and EPSS: loading from the tracker record. They are read when this page loads and are not shown without JavaScript. They change daily and are not part of "Source last updated".

Not reported by tracked sources.

Not reported by tracked sources.

Tracker inference. Guidance from the decision tier: No action now. Remediate within standard update timelines. Monitor for change.