The Config::IniFiles Perl module before version 3.001000 is vulnerable to OS command injection due to improper neutralization of special elements in the filename argument passed to the _make_filehandle function. This function uses Perl's 2-argument open() on the -file parameter, which interprets filenames starting or ending with pipe characters ("| cmd", "cmd |") or redirection operators ("> path", ">> path") as commands or redirections rather than file paths. Consequently, if untrusted input is passed to the -file argument, an attacker can execute arbitrary OS commands or truncate files with the privileges of the running process. The vulnerability does not affect usage with in-memory scalar references. There is no vendor advisory or patch currently available for this issue.

An attacker who can supply untrusted input to the -file argument of Config::IniFiles before version 3.001000 can execute arbitrary operating system commands or overwrite files with the permissions of the process running the Perl code. This can lead to unauthorized command execution and potential system compromise or data loss. The impact depends on the context in which the module is used and the privileges of the process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input to the -file argument of Config::IniFiles. Using in-memory scalar references for configuration data (-file => \$text) is not affected by this vulnerability and can be used as a safer alternative.