The IO::Compress Perl module versions prior to 2.220 contain a code injection vulnerability (CWE-95) in the File::GlobMapper component. Specifically, the _parseOutputGlob() function wraps a user-supplied output glob string in double quotes and stores it in parser state. Later, _getFiles() evaluates this stored string using Perl's eval function. If the output glob contains a literal double quote, it prematurely closes the wrapper, allowing the subsequent characters to be executed as arbitrary Perl code. This flaw enables an attacker to execute arbitrary code with the privileges of the calling process.

Successful exploitation allows an attacker to execute arbitrary Perl code on the affected system with the privileges of the process running IO::Compress. This can lead to full compromise of the affected process, including confidentiality, integrity, and availability impacts. The vulnerability has a CVSS v3.1 score of 7.3 (high severity) and can be exploited remotely without user interaction or privileges.

According to the Red Hat advisory, no effective mitigation currently meets their criteria for ease of use, applicability, and stability. Users should upgrade to IO::Compress version 2.220 or later when available. Red Hat has released updated packages for Red Hat Enterprise Linux 7 Extended Life Cycle Support that address this vulnerability. Applying these updates is the recommended remediation. Until a fix is applied, no reliable workaround is documented.