CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

[Robert Rothenberg <rrwo () cpansec org>]

========================================================================
CVE-2026-78497                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-78497

  Distribution:  JQ-Lite
      Versions:  before 2.51
      MetaCPAN: https://metacpan.org/dist/JQ-Lite
      VCS Repo: https://github.com/kawamurashingo/JQ-Lite


JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a
query's regular expression by compiling it with string eval

Description
-----------
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a
query's regular expression by compiling it with string eval.

The pattern given to test(), match(), or the match and =~ conditions of
select() is placed in a `qr'...'` literal and compiled as source text,
so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single
quotes in the pattern are escaped, but a code block runs in place and
needs none.

An attacker who supplies a query, or text that an application inserts
into the pattern of one, can execute arbitrary Perl code in the calling
process.

Problem types
-------------
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated
  Code ('Eval Injection')

Solutions
---------
Upgrade to JQ-Lite 2.51 or later.

References
----------
https://github.com/kawamurashingo/JQ-Lite/commit/c461721ae3d5a90d6d94dbb234c1b8dfee5c1769.patch
https://metacpan.org/release/SHINGO/JQ-Lite-2.51/changes