CVE-2026-78497: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

JQ::Lite versions prior to 2.51 for Perl execute embedded Perl code within query regular expressions by compiling them with string eval. The vulnerability arises because the pattern given to test(), match(), or select() conditions is placed inside a qr'...' literal and compiled as source text, allowing (?{ ... }) code blocks to run without the use of 're eval'. Although single quotes in the pattern are escaped, the code block itself executes directly. This improper neutralization of directives in dynamically evaluated code (CWE-95) enables an attacker who controls the query or inserted text to execute arbitrary Perl code within the calling process.

An attacker who can supply or influence the query or text inserted into the pattern can execute arbitrary Perl code in the process running JQ::Lite. This can lead to full compromise of the affected application environment, including unauthorized code execution and potential system control.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input in query patterns or sanitize inputs rigorously to prevent injection of code blocks.