The DBI module for Perl versions prior to 1.650 is vulnerable to code injection through the Profile attribute. When a string is assigned to the Profile attribute of a DBI handle, DBI splits it into path, package, and arguments, then interpolates the package part inside a string eval without validating the package name. This allows an attacker who can influence the Profile attribute—via the DBI_PROFILE environment variable, direct attribute assignment, or DSN driver-attribute clauses—to execute arbitrary Perl code, including system commands, on the host process. The strongest remote attack vector is through network-exposed DBI::Gofer or DBI::ProxyServer services where the per-request DSN affects the Profile attribute, enabling remote code execution on the broker host. Red Hat has issued patches for this vulnerability in their Enterprise Linux 10 distributions.

Successful exploitation allows an attacker to execute arbitrary Perl code on the host system with the privileges of the affected process. This includes running system commands, potentially leading to full system compromise. The vulnerability affects local and remote attack vectors, especially when DBI::Gofer or DBI::ProxyServer services are network-exposed and accept attacker-controlled DSNs. The CVSS v3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.

Red Hat has released security updates that fix this vulnerability in Red Hat Enterprise Linux 10 and its variants. Users should apply the official patches provided in Red Hat Advisory RHSA-2026:49514. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation is required once the update is applied.