CVE-2026-64193 describes an improper neutralization of directives in dynamically evaluated code (eval injection) in the Net::DNS Perl module up to version 1.55. The vulnerability exists in the Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose function, which parses the EXTRA-TEXT field of the EDNS EXTENDED-ERROR option (RFC 8914). It tokenizes raw bytes and passes them to Perl's eval function. While some escaping is done for $ and @ characters, backticks are not escaped, enabling an attacker to inject commands that get executed if the EXTENDED-ERROR option is called in array context with a crafted payload containing backticks.

An attacker can exploit this vulnerability to execute arbitrary commands remotely on a system using the vulnerable Net::DNS Perl module. This can lead to full system compromise depending on the privileges of the process using Net::DNS. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid calling $pkt->edns->option('EXTENDED-ERROR') in array context or processing untrusted EDNS EXTENDED-ERROR options. Monitor vendor communications for an official fix or update.