WWW::Mechanize::Cached prior to version 2.00 uses a default Cache::FileCache backend under /tmp/FileCache with directory permissions set to 0777 and no sticky bit, making the cache world-writable. Cache entries are named by sha1_hex of the request and deserialized using Storable::thaw. A local attacker with write access to the cache can replace cache entries with malicious frozen HTTP::Response objects. Because Storable::thaw invokes class hooks such as STORABLE_thaw, DESTROY, or overload, this can lead to arbitrary code execution in the victim process.

Local attackers with write access to the cache directory can forge cached HTTP responses that the victim process will deserialize, potentially leading to arbitrary code execution. This compromises the confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported. The vulnerability requires local access and the ability to write to the cache directory.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions to the cache directory to trusted users only and avoid running WWW::Mechanize::Cached with elevated privileges or in environments where untrusted users have local access. Consider configuring an explicit cache backend with secure permissions if supported.