CVE-2026-14380
published 2026-07-07CVE-2026-14380: DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.50%
41.9th percentile
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.
An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| perl-dbi_1.641 | perl-dbi | — | — |
| perl | dbi | < 1.650 | 1.650 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for the DBI_PROFILE environment variable being set to values containing package names or special characters, which could indicate exploitation of the Profile attribute injection. ↗
- →Detect DSN strings containing 'Profile=>' in driver-attribute clauses (e.g., dbi:Driver(Profile=>SPEC):db), especially in network-exposed DBI::Gofer or DBI::ProxyServer request DSNs, as these can carry attacker-controlled code. ↗
- →Alert on string eval execution within DBI's Profile attribute processing where the package name portion is interpolated without validation — look for eval calls in DBI Profile parsing code paths. ↗
- ·Vulnerable versions are DBI before 1.650 for Perl; upgrade to 1.650 or later to remediate. ↗
- ·Avoid setting the DBI_PROFILE environment variable from untrusted sources to reduce exploitation risk. ↗
- ·Ensure DSN driver-attribute clauses, particularly Profile=>SPEC, are not populated with unvalidated or untrusted input. ↗
- ·Network-exposed DBI::Gofer and DBI::ProxyServer deployments are at highest risk as per-request DSNs from clients can reach the Profile attribute and trigger remote code execution. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute
vendor_redhat·2026-08-11·CVSS 8.8
CVE-2026-19546 [HIGH] CWE-94 DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute
DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute
A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.
For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
Statement: For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
Mitigation: For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
Package: perl-DBI (Red Hat Enterprise Linux 10) - Affected
Package: perl-DBI (Red Hat Enterprise Linux 6) - Not affected
Package: perl-DBI (Red H
Red Hat
DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute
vendor_redhat·2026-07-07·CVSS 8.8
CVE-2026-14380 [HIGH] CWE-94 DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute
DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.
An attacker controlling any of those inputs runs a
GHSA
A flaw was found in DBI.
ghsa_unreviewed·2026-08-11·CVSS 8.8
CVE-2026-19546 [HIGH] CWE-94 A flaw was found in DBI.
A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.
For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
VulDB
DBI up to 1.649 Profile code injection (EUVD-2026-42123)
vuldb·2026-07-08
CVE-2026-14380 [CRITICAL] DBI up to 1.649 Profile code injection (EUVD-2026-42123)
A vulnerability labeled as critical has been found in DBI up to 1.649. Impacted is an unknown function of the component Profile. The manipulation of the argument Profile results in code injection.
This vulnerability is reported as CVE-2026-14380. The attack can be launched remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19546 DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute
bugzilla·2026-08-11·CVSS 8.8
CVE-2026-19546 [HIGH] CVE-2026-19546 DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute
CVE-2026-19546 DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute
Incomplete fix for CVE-2026-14380 in rhel 9.8.z and 10.2.z.
Details of CVE-2026-14380:
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a di
Bugzilla
CVE-2026-14380 perl-DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute [fedora-all]
bugzilla·2026-07-16·CVSS 8.8
CVE-2026-14380 [HIGH] CVE-2026-14380 perl-DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute [fedora-all]
CVE-2026-14380 perl-DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile att
Bugzilla
CVE-2026-14380 DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute
bugzilla·2026-07-07·CVSS 8.8
CVE-2026-14380 [HIGH] CVE-2026-14380 DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute
CVE-2026-14380 DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.
An attacker controlling any of
2026-07-07
Published