CVE-2026-14380: DBI Perl Code Injection via Profile Attribute (CVSS 8.8)

Technical summary

CVE-2026-14380 is a code injection vulnerability in Perl DBI versions before 1.650 stemming from unsafe string evaluation of the Profile attribute. The Profile attribute is parsed to extract path, package name, and arguments, then executed via string eval() without validating the package name component. Three input vectors can introduce untrusted data: the DBI_PROFILE environment variable, programmatic handle attribute assignment (via the Profile property), and DSN driver-attribute clauses embedded in connection strings (e.g., dbi:Driver(Profile=>SPEC):db). The string eval interpolates user-controlled content directly into Perl code, bypassing any sandboxing. Network-exposed DBI::Gofer or DBI::ProxyServer instances are particularly vulnerable because per-request DSN parameters from remote clients can reach the Profile attribute, enabling unauthenticated or low-privilege remote code execution.

Business impact

A successful exploit grants an attacker arbitrary code execution within the Perl process hosting the DBI connection. In production environments, this typically means full compromise of the database client process, potential lateral movement to the database server itself, and access to all credentials and data the process can reach. For organizations running database brokers or application servers that use DBI, a remote attacker can execute system commands, exfiltrate sensitive data, install persistence mechanisms, or disrupt service availability. The vulnerability's severity is elevated because DBI is widely used across Perl-based infrastructure, including legacy enterprise systems and web applications.

Affected systems

Any system running Perl DBI versions before 1.650 is affected. This includes Perl applications, web frameworks (such as Catalyst or Mojolicious), legacy enterprise systems, and database broker services (DBI::Gofer, DBI::ProxyServer). Systems are at highest immediate risk if they: expose DBI-based database brokers to untrusted networks, accept DSN connection strings from user input, or run applications in environments where the DBI_PROFILE environment variable can be set by untrusted processes. Administrators should inventory Perl modules in production environments and check DBI versions across development, testing, and production systems.

Exploitability

The vulnerability requires authenticated access or control over one of three input vectors: environment variables, direct code attribute assignment, or DSN connection parameters. For local attackers or developers with code access, exploitation is trivial—setting Profile to a malicious string executes code immediately. For remote attackers, the primary vector is network-exposed DBI::Gofer or DBI::ProxyServer instances that accept untrusted DSN parameters from clients. The CVSS score of 8.8 (HIGH, AV:N/AC:L/PR:L) reflects that remote exploitation requires authenticated access or a pre-established connection, but once that condition is met, no additional complexity is needed—any crafted DSN or Profile value reliably executes code. Unauthenticated remote exploitation is possible if the broker is misconfigured to accept unauthenticated connections.

Remediation

Upgrade Perl DBI to version 1.650 or later. This patch version includes validation of the Profile attribute package name, preventing arbitrary code execution. In parallel, apply defense-in-depth measures: restrict network access to DBI brokers (DBI::Gofer, DBI::ProxyServer) using firewalls or VPNs; avoid accepting DSN connection strings from untrusted sources; do not allow untrusted processes to set the DBI_PROFILE environment variable; and review code that programmatically assigns the Profile attribute. Organizations unable to patch immediately should disable or isolate database brokers from untrusted networks.

Patch guidance

Verify your Perl DBI version using: perl -MDBI -e 'print $DBI::VERSION'. If version is below 1.650, update DBI via your package manager (apt, yum, cpan, etc.) or directly from CPAN. For cpan: cpan DBI or cpanm DBI. Test the upgrade in a non-production environment first, especially if your application uses custom Profile configurations. After upgrading, confirm the version change and restart any long-running Perl processes or application servers. Coordinate with teams managing database brokers to ensure they are also updated.

Detection guidance

Monitor for suspicious Profile attribute usage: log or alert on DBI_PROFILE environment variable being set, especially with system command patterns (backticks, qx(), system(), exec(), or fork()). In source code, flag any assignment to a DBI handle's Profile attribute with untrusted input, particularly from environment variables, user input, or DSN parameters. Network-based detection is difficult; focus on application-level logging and code review. Check for unexpected child processes spawned by Perl applications connected to databases, and monitor outbound network connections from DBI client processes that differ from normal patterns. Implement egress filtering to restrict unexpected outbound connections from database-connected services.

Why prioritize this

This vulnerability merits immediate patching due to its combination of high severity (CVSS 8.8), ease of exploitation once an input vector is accessible, and wide deployment of DBI across Perl infrastructure. Unlike many code-injection vulnerabilities that require elaborate payloads, this one executes arbitrary code from a simple string assignment. Organizations running DBI-based database brokers exposed to networks, or applications that accept user-supplied DSN parameters, should treat this as critical. Even systems without direct network exposure benefit from prompt patching, as insider threats or compromised dependencies could exploit local input vectors.

Risk score, explained

The CVSS 8.8 HIGH score reflects: Network exploitability (AV:N) via exposed brokers or network-reachable components; Low attack complexity (AC:L) because exploitation requires only a crafted string; Low privilege requirement (PR:L) as authenticated access to the broker or ability to set environment variables typically requires some foothold; and High confidentiality, integrity, and availability impact (C:H/I:H/A:H) because arbitrary code execution in a database client process typically compromises all data and functionality it can access. The score does not account for the absence of KEV status (not yet added to the Known Exploited Vulnerabilities catalog) but reflects the genuine severity of unauthenticated remote code execution in widely deployed software.

Frequently asked questions