JQ::Lite: Arbitrary Perl code execution via regex code blocks in queries
Summary
JQ::Lite for Perl compiles the regular expression pattern of test(), match() and select() conditions as source text using string eval. A (?{ ... }) code block in the pattern runs without use re 'eval', so the single-quote escaping does not prevent it. An attacker who can supply a query, or text that an application inserts into such a pattern, can execute arbitrary Perl code in the calling process.
Affected
- JQ::Lite for Perl, versions before 2.51 (affected range according to the CNA: 0 to before 2.51)
Fixed in
- Upgrade to JQ::Lite 2.51 or later.
- The fix commit replaces the string eval with a qr// construct in lib/JQ/Lite/Util/Transform.pm.
Workaround
- No vendor-documented workaround. The vendor's solution is the upgrade.
- Until upgraded, do not pass user-supplied queries or user-controlled text into JQ::Lite test(), match() or select() conditions.
Exploitation
- No evidence of exploitation in the wild found. The CVE is not listed in CISA KEV.
- No public proof of concept found in our research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory Perl systems for JQ::Lite, including CPAN installs and distribution packages.
- Upgrade to JQ::Lite 2.51 or later where it is in use.
- Until the upgrade, block untrusted input from reaching query or regex parameters and review applications that build these patterns from user input.
- Priority: medium where Perl applications process untrusted queries, otherwise low.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit (patch) github.com
- JQ-Lite 2.51 changelog metacpan.org
- oss-security post www.openwall.com
- OSV record CVE-2026-78497 osv.dev
- Mend vulnerability database www.mend.io
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:22.
Original description (NVD)
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.