CVE-2026-14380 is an eval injection vulnerability in the HMBRAND DBI Perl module versions before 1.650. The vulnerability arises because the Profile attribute, when set as a string, is split into components and the package part is interpolated inside a string eval without validation. This allows an attacker controlling the Profile attribute via environment variables, direct assignment, or DSN clauses to execute arbitrary Perl code, including system commands. Remote exploitation is possible if DBI::Gofer or DBI::ProxyServer is network-exposed and accepts per-request DSNs that influence the Profile attribute.

Successful exploitation allows arbitrary Perl code execution within the host process running the vulnerable DBI module. This can lead to full system compromise, including running system commands. Remote exploitation is feasible in scenarios where the DBI::Gofer or DBI::ProxyServer is exposed and accepts attacker-controlled DSNs affecting the Profile attribute.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input to set the Profile attribute, and do not expose DBI::Gofer or DBI::ProxyServer services to untrusted networks. Monitor vendor channels for official patches or updates.