Data::Dump::Streamer versions before 3.00 for Perl contain a code injection vulnerability via unescaped regular expression patterns in the _dump_qr function. This occurs because certain characters in regex patterns are not properly escaped, allowing embedded code to execute when the dumped data is later evaluated. An attacker supplying a crafted regex pattern that is compiled, dumped, and restored with eval or do can execute arbitrary Perl code.