CVE-2026-14380 is an eval injection vulnerability in the HMBRAND DBI Perl module versions before 1.650. The DBI handle's Profile attribute is split into path, package, and arguments, and the package part is interpolated in a string eval without validation. This allows attacker-controlled input to execute arbitrary Perl code, including system commands. The Profile attribute can be influenced via the DBI_PROFILE environment variable, direct attribute assignment, or DSN driver-attribute clauses. Network-exposed DBI::Gofer or DBI::ProxyServer instances that accept per-request DSNs can be remotely exploited to execute code on the broker host.

Successful exploitation allows arbitrary Perl code execution within the host process, leading to full compromise including confidentiality, integrity, and availability impacts. Attackers can run system commands and potentially control the affected system. Remote exploitation is feasible in setups exposing DBI::Gofer or DBI::ProxyServer with attacker-controlled DSNs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input for the Profile attribute, do not expose DBI::Gofer or DBI::ProxyServer services to untrusted networks, and restrict environment variables such as DBI_PROFILE. Monitor vendor channels for patches or official mitigations.