JQ::Lite Flaw Allows Perl Code Execution in Versions Before 2.51

The JQ::Lite Perl module contains a security flaw that permits the execution of arbitrary Perl code. This vulnerability, identified as CVE-2026-78497, impacts all versions of the distribution prior to 2.51. The issue arises because the module compiles regular expressions found within queries using string eval, which can process embedded code rather than treating it as literal text.

How it unfolded

• Robert Rothenberg posted the security advisory to the oss-security mailing list on October 18.
• The CPAN Security Group published the details regarding CVE-2026-78497 alongside the advisory.
• The notice specifies that versions before 2.51 are vulnerable to this code execution flaw.

Who is affected

Any system using the JQ::Lite Perl module in versions earlier than 2.51 is exposed to this risk. The vulnerability exists in the way the module handles regular expressions within query strings. When the module processes these expressions, it uses string eval to compile them. This mechanism fails to distinguish between regex patterns and executable Perl code, allowing an attacker to inject and run arbitrary code if they can control the query input.

Our take on the response

The disclosure provides clear version boundaries for the affected software. By specifying that versions before 2.51 are vulnerable, administrators can quickly identify at-risk installations without ambiguity. The use of string eval for regex compilation is a known risky pattern in Perl development. That suggests this flaw stems from legacy coding practices that prioritize flexibility over strict input sanitization, a common issue in older open-source libraries.

Who needs to act first

Teams should prioritize updating systems that expose JQ::Lite to untrusted input sources. Check inventory records to locate all instances of versions prior to 2.51. Before applying any changes, create backups of current configurations and data. Test the update in a non-production environment to ensure compatibility with existing applications. If immediate patching is not possible, restrict access to services using this module and monitor logs for unusual activity.

What to do and how to stay safe: JQ::Lite

• Scan production environments for JQ::Lite versions earlier than 2.51.
• Upgrade to version 2.51 or later once the vendor provides an update.
• Monitor application logs for signs of unauthorized code execution attempts.
• Restrict network access to services relying on this vulnerable module.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-78497?

It is a vulnerability in JQ::Lite versions before 2.51 that allows Perl code execution via regular expressions.

Which versions of JQ::Lite are affected?

All versions before 2.51 are affected by this security flaw.

Who disclosed this vulnerability?

Robert Rothenberg posted the advisory on the oss-security mailing list.