CVE-2026-14380: Perl DBI RCE Vulnerability

CVE-2026-14380 Overview

CVE-2026-14380 is a code injection vulnerability [CWE-95] affecting the Perl DBI module in versions before 1.650. The flaw allows attackers to execute arbitrary Perl code through the Profile attribute of a DBI handle. When a string is assigned to Profile, DBI splits it into path, package, and arguments, then interpolates the package portion in a string eval without validating the package name. Any caller-influenced value that reaches the Profile attribute results in arbitrary Perl execution in the host process, including invocation of system commands.

Critical Impact
Network-exposed DBI::Gofer or DBI::ProxyServer deployments allow remote clients to execute arbitrary Perl code on the broker host through per-request DSN inputs.

Affected Products

Perl DBI module versions before 1.650
Applications using DBI::Gofer with untrusted DSN inputs
Applications using DBI::ProxyServer with client-controlled DSN inputs

Discovery Timeline

2026-07-07 - CVE-2026-14380 published to NVD
2026-07-07 - OpenWall oss-security disclosure posted
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-14380

Vulnerability Analysis

The vulnerability resides in lib/DBI/Profile.pm, where DBI parses the Profile attribute string. DBI splits the value into three components: a path, a package name, and arguments. The package component is then passed to a string eval construct that loads the profile package. Because DBI performs no validation on the package name before interpolation, any embedded Perl syntax executes in the interpreter context.

An attacker who influences the Profile value can inject arbitrary Perl, including calls to system(), qx//, or open() with pipe modes. The result is arbitrary command execution in the host process running the DBI application.

Root Cause

The root cause is the use of string eval on untrusted input without input validation, classified as improper neutralization of directives in dynamically evaluated code [CWE-95]. DBI treated the package component of Profile as trusted developer input, but three attack surfaces expose it to external influence.

Attack Vector

The Profile attribute can be set from three sources that carry untrusted data:

The DBI_PROFILE environment variable
A direct attribute assignment on a DBI handle
A DSN driver-attribute clause of the form dbi:Driver(Profile=>SPEC):db

The most severe exposure is a network-facing DBI::Gofer or DBI::ProxyServer where per-request DSN values reach the Profile attribute. A remote client can craft a DSN that carries injected Perl, causing the broker to execute attacker-controlled code.

text

 use Exporter ();
 use UNIVERSAL ();
 use Carp;
+use Module::Load ();
 
 use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge);

Source: GitHub Patch Commit b73d5d9. The patch replaces the string eval package loader with Module::Load, which validates package names before loading and does not interpolate strings into eval.

Detection Methods for CVE-2026-14380

Indicators of Compromise

Unexpected child processes spawned by Perl processes hosting DBI applications, especially perl, sh, or bash invocations from web or database broker workers
Anomalous DSN strings containing shell metacharacters, semicolons, backticks, or Profile=> clauses in DBI::Gofer or DBI::ProxyServer request logs
Non-empty or unusual DBI_PROFILE environment values on production hosts running Perl services

Detection Strategies

Inspect application and proxy logs for DSN patterns matching dbi:.*\(Profile=> originating from untrusted clients
Alert on Perl interpreter processes executing system()-style syscalls that spawn shells or network utilities
Audit source code and configuration for direct assignment of caller-influenced values to a DBI handle's Profile attribute

Monitoring Recommendations

Baseline the process tree of Perl-based DBI services and alert on deviations that include shell or interpreter children
Enable command-line logging on hosts running DBI::Gofer and DBI::ProxyServer and forward events to a centralized data lake for correlation
Track environment variable changes to DBI_PROFILE across managed hosts using endpoint telemetry

How to Mitigate CVE-2026-14380

Immediate Actions Required

Upgrade the Perl DBI module to version 1.650 or later on all systems
Restrict network exposure of DBI::Gofer and DBI::ProxyServer to trusted networks only, pending patching
Sanitize or reject any client input that reaches DSN parsing or DBI handle attribute assignment
Unset or restrict the DBI_PROFILE environment variable in service-management units for Perl daemons

Patch Information

The fix is available in DBI 1.650, released through CPAN. The patch, applied in lib/DBI/Profile.pm, introduces Module::Load for profile package loading and removes the vulnerable string eval interpolation. See the GitHub Security Advisory GHSA-ch8w-hxc2-v557 and the MetaCPAN DBI 1.650 changelog for release details.

Workarounds

Do not pass caller-influenced strings to the Profile attribute of any DBI handle
Strip Profile driver-attribute clauses from DSN strings before passing them to DBI->connect
Disable or firewall DBI::Gofer and DBI::ProxyServer endpoints exposed to untrusted clients

bash

# Upgrade DBI via CPAN to the patched release
cpan install DBI@1.650

# Verify installed version
perl -MDBI -e 'print $DBI::VERSION, "\n"'

# Remove any inherited DBI_PROFILE from service environments
unset DBI_PROFILE