The vulnerability in IO::Compress occurs because the _parseOutputGlob() function wraps a user-supplied output glob string in double quotes and stores it. Later, _getFiles() evaluates this stored string using Perl's eval STRING. If the output glob contains a literal double quote, it closes the wrapping quotes prematurely, allowing the attacker to append arbitrary Perl code that gets executed. This is a classic example of CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection').

Successful exploitation allows an attacker to execute arbitrary Perl code with the privileges of the process running IO::Compress. This can lead to full compromise of the affected system or application depending on the privilege level. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted input in the output glob parameter or restrict usage to trusted sources only. Monitor vendor channels for updates and apply patches promptly once released.