Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-78497— JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

Quick assessment

Affected
CVE-2026-78497
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 语言中，JQ::Lite 2.51 之前的版本存在一个安全漏洞：当查询中的正则表达式被编译时，若其中嵌入了 Perl 代码，系统会通过 执行该代码。 具体而言，传递给 、 函数，或 函数中 与 条件的正则表达式模式，会被放入 字面量中，并作为源代码文本进行编译。因此，模式中若包含 形式的代码块，即使未启用 ，该代码块仍会被执行。虽然模式中的单引号会被转义，但代码块本身在原地执行，无需转义即可运行。 攻击者若能够控制查询内容，或控制应用程序插入到正则表达式模式中的文本，便可在调用该函数的进程中执行任意

AI Predicted 9.8 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 2.51 affected

I. Basic Information for CVE-2026-78497

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
Source: CVE Program / CVE List V5
Vulnerability Description
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 2.51 -

II. Public POCs for CVE-2026-78497

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78497

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-78497 (1)

Other References for CVE-2026-78497 (1)

IV. Related Vulnerabilities

Same weakness: CWE-95

V. Comments for CVE-2026-78497

No comments yet

Leave a comment