Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-07T22:04:49 DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-94

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands. The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the execution of unauthorized Perl code, including system commands. An attacker with control over certain inputs, such as environment variables or connection string parameters, could exploit this to achieve arbitrary code execution on the affected system. In some configurations, this could lead to remote code execution.

This Important vulnerability in the Perl DBI component allows for arbitrary code execution due to improper validation of the `Profile` attribute. An attacker can exploit this by controlling inputs such as the `DBI_PROFILE` environment variable or DSN parameters, leading to the execution of unauthorized Perl code. To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=>SPEC):db`, are not populated with unvalidated or untrusted input. Red Hat Enterprise Linux 10 2026-08-03T00:00:00Z RHSA-2026:49514 perl-DBI-0:1.643-26.el10_2.3 Red Hat Enterprise Linux 6 Out of support scope perl-DBI Red Hat Enterprise Linux 7 Affected perl-DBI Red Hat Enterprise Linux 8 Affected perl-DBI Red Hat Enterprise Linux 8 Affected perl-DBI:1.641/perl-DBI Red Hat Enterprise Linux 9 Affected perl-DBI https://www.cve.org/CVERecord?id=CVE-2026-14380 https://nvd.nist.gov/vuln/detail/CVE-2026-14380 https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557 https://metacpan.org/release/HMBRAND/DBI-1.650/changes