CVE-2026-78497
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
Unknown product
CVSS
8.4HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.51CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.
The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a qr'...' literal and compiled as source text, so a (?{ ... }) code block in it runs without use re 'eval'. Single quotes in the pattern are escaped, but a code block runs in place and needs none.
An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
Text from CVE List
Affected versions 1
- Productaffected: all versions before 2.51CVE List