CVE-2026-14380: DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.650-1 - Upgrade
Upgrade
DBI (Perl)to a version that resolves this vulnerability.Fixed in 1.650 - Configuration
Ensure the DBI Profile attribute is not populated from untrusted input via DBI_PROFILE, direct Profile assignment, or a DSN driver-attribute clause like dbi:Driver(Profile=>SPEC):db, since this can lead to arbitrary Perl code execution.
DBI Profile attribute (DBI_PROFILE env var / direct assignment / DSN clause dbi:Driver(Profile=>...)) = Do not set Profile using any caller-influenced or untrusted data
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14380?
CVE-2026-14380 has a risk score of 83, indicating it's a high-severity vulnerability.
What does CVE-2026-14380 affect?
CVE-2026-14380 affects DBI versions prior to 1.650 for Perl, which is vulnerable to code injection.
How do I fix CVE-2026-14380?
To fix CVE-2026-14380, upgrade your DBI to version 1.650 or later.
What kind of vulnerability is CVE-2026-14380?
CVE-2026-14380 is classified as a code injection vulnerability.
What is the impact of CVE-2026-14380 on applications?
The impact of CVE-2026-14380 can include unauthorized execution of code due to unvalidated package names being interpolated in eval.