What is the CVSS score of CVE-2026-14380?

CVE-2026-14380 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Perl DBI are affected by CVE-2026-14380?

CVE-2026-14380 in Perl's DBI module (versions <1.650) allows arbitrary code execution through unsanitized Profile attributes; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-14380?

Within 24 hours, identify and inventory all systems running Perl DBI module versions prior to 1.650, with priority focus on any database brokers or proxy services exposed to network clients. Within 7 days, upgrade DBI to version 1.650 or later on all affected systems and validate patch deployment across environments. Within 30 days, conduct a code audit to eliminate any code paths where Profile attributes receive untrusted input, and implement input validation and environment variable controls to restrict DBI_PROFILE values.

Perl DBI CVE-2026-14380

Q: How to fix or mitigate CVE-2026-14380?

Within 24 hours, identify and inventory all systems running Perl DBI module versions prior to 1.650, with priority focus on any database brokers or proxy services exposed to network clients. Within 7 days, upgrade DBI to version 1.650 or later on all affected systems and validate patch deployment across environments. Within 30 days, conduct a code audit to eliminate any code paths where Profile attributes receive untrusted input, and implement input validation and environment variable controls to restrict DBI_PROFILE values.

HIGH

Eval Injection (CWE-95)

2026-07-07 CPANSec

RCE Code Injection Dbi Hmbrand

8.8

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Full RCE (C/I/A:H), but exploitation needs a non-default data flow routing untrusted input into Profile (typically a proxy client), so AC:H and PR:L rather than PR:N.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:15 vuln.today

Analysis Generated

Jul 22, 2026 - 18:15 vuln.today

CVE Published

Jul 07, 2026 - 22:04 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 07, 2026 - 22:04 cve.org

HIGH 8.8

DescriptionCVE.org

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.

When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.

Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.

The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.

An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.

AnalysisAI

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influence a handle's Profile attribute to run host commands. DBI splits a string-form Profile spec into path/package/arguments and interpolates the package portion into a string eval with no validation, so any untrusted value reaching Profile - via the DBI_PROFILE environment variable, direct attribute assignment, or a dbi:Driver(Profile=>SPEC):db DSN clause - becomes executable Perl. The most severe exposure is a network-facing DBI::Gofer or DBI::ProxyServer whose per-request DSN reaches Profile, letting a remote client execute code on the broker. There is no public exploit identified at time of analysis and EPSS is low (0.24%), but technical impact is total.

Technical ContextAI

DBI is the standard database-access abstraction layer for Perl, sitting between applications and DBD::* drivers; its Profile subsystem (lib/DBI/Profile.pm) instruments method timing and can load a pluggable profiling class named in the Profile attribute. The flaw is a classic CWE-95 (eval injection / improper neutralization of directives in dynamically evaluated code): the internal _auto_new routine parsed the Profile spec and executed eval "require $package", string-interpolating an attacker-influenced $package directly into a Perl string eval. Because Perl's string eval compiles and runs arbitrary code, a value like a package name containing embedded Perl (e.g. system calls) executes immediately rather than merely loading a module. The upstream fix replaces the string eval with a block eval calling Module::Load::load, which treats the value strictly as a module name and cannot execute injected code.

RemediationAI

Vendor-released patch: DBI 1.650 - upgrade the DBI module to 1.650 or later (fix commit b73d5d9901767fc1d16b6661ef08fbed4532e259, which replaces the vulnerable string eval with Module::Load::load). Until you can patch, ensure no caller-influenced value reaches a handle's Profile attribute: unset or hard-pin the DBI_PROFILE environment variable in service environments (side effect: disables env-driven profiling), reject or sanitize DSN strings so client-supplied dbi:Driver(Profile=>...):db clauses cannot pass through, and never assign externally derived data to the Profile attribute. For network-facing DBI::Gofer/DBI::ProxyServer brokers, restrict the accepted DSN/attribute set and place the service behind authentication and network ACLs, or take it offline until patched, since it is the strongest remote code-execution path. References: https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557 and the patch at https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch.

More in Dbi

View all

CVE-2026-14739 CRITICAL Act Now

9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-15043 CRITICAL Act Now

9.8 Jul 14

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' c

CVE-2026-10879 CRITICAL Act Now

9.8 Jun 05

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL stat

CVE-2026-9698 CRITICAL Act Now

9.8 Jun 09

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error

CVE-2026-60082 CRITICAL Act Now

9.1 Jul 14

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a

CVE-2026-14740 CRITICAL Act Now

9.1 Jul 07

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL pas

CVE-2026-60081 HIGH This Week

7.5 Jul 14

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows a

Same weakness CWE-95 – Eval Injection

View all

CVE-2025-24893 CRITICAL POC

9.8

CVE-2024-21650 CRITICAL POC

10.0

CVE-2013-10051 CRITICAL POC

9.3

CVE-2013-10070 CRITICAL POC

10.0

CVE-2026-33017 CRITICAL POC

9.3

CVE-2026-19295 CRITICAL POC

9.9

CVE-2024-7954 CRITICAL POC

9.8

CVE-2024-36401 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Micro 6.2	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected

CVE-2026-14380 vulnerability details – vuln.today

Back

Perl DBI CVE-2026-14380

Severity by source

CVSS VectorVendor: CPANSec

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Dbi

Same weakness CWE-95 – Eval Injection

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code