WWW::Mechanize::Cached versions prior to 2.00 use a default Cache::FileCache backend that creates cache directories under /tmp/FileCache with mode 0777 and no sticky bit, making them world-writable. Cache entries are named by sha1_hex of the request and deserialized via Storable::thaw. A local attacker with write access to the cache directory can replace a victim's cached HTTP response with a malicious frozen HTTP::Response object. Upon the victim's next cache hit, the deserialization process can invoke side-effectful STORABLE_thaw, DESTROY, or overload hooks in loaded classes, leading to arbitrary code execution. This vulnerability combines incorrect permission assignment (CWE-732) and unsafe deserialization (CWE-502).

An attacker with local write access to the cache directory can cause victim processes using WWW::Mechanize::Cached to execute arbitrary code by injecting malicious serialized HTTP responses. This can lead to local response forgery and code execution with the privileges of the victim process. The CVSS score is 5.3 (medium severity), reflecting the requirement for local access and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions to the cache directory to trusted users only and avoid running WWW::Mechanize::Cached in environments where untrusted local users have write access to the cache directory. Consider configuring an explicit cache backend with secure permissions if supported.