DBI::SQL::Nano, the built-in mini-SQL engine for Perl's DBI module, incorrectly evaluates the <= and >= SQL operators on text values in versions from 1.42 before 1.651. Specifically, in the non-numeric string branch of the is_matched method, the <= operator is evaluated using Perl's ge operator, and the >= operator is evaluated using Perl's le operator, effectively inverting their intended logic. This flaw affects queries over file-backed tables using DBI::SQL::Nano as the query engine, which is used by default when SQL::Statement is not installed or when forced by the DBI_SQL_NANO environment variable. The incorrect evaluation can cause WHERE clauses to silently return incorrect rows, potentially undermining filtering for policy or authorization decisions.

The vulnerability causes incorrect evaluation of text-based <= and >= predicates in SQL queries executed by DBI::SQL::Nano. Applications relying on these predicates to filter file-backed data for policy enforcement or authorization may receive incorrect query results, potentially exposing unauthorized data or causing logic errors. The impact depends on the application's reliance on these predicates and the use of DBI::SQL::Nano as the query engine.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying on DBI::SQL::Nano for critical filtering of file-backed data or consider installing SQL::Statement to avoid fallback to DBI::SQL::Nano. Review application logic that depends on <= and >= predicates for text comparisons in queries using DBI::SQL::Nano.