Code injection in DBI::Profile via Profile attribute (CVE-2026-14380)

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package, and arguments, and interpolates the package part in a string eval with no validation, allowing arbitrary Perl code execution. The Profile attribute can be set from untrusted sources such as the DBI_PROFILE environment variable, direct attribute assignment, or a DSN driver-attribute clause, enabling remote code execution in network-exposed DBI::Gofer/DBI::ProxyServer setups. Affected versions: - < 1.650 We recommend updating to: 1.650. CVSS 8.8 · our assessment: this_week Reference: https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557 Details: https://vuln.today/cve/CVE-2026-14380