JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

Overview

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.

The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a qr'...' literal and compiled as source text, so a (?{ ... }) code block in it runs without use re 'eval'. Single quotes in the pattern are escaped, but a code block runs in place and needs none.

An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.

Affected

• JQ-Lite < 2.51

Remediation

Upgrade to JQ-Lite 2.51 or later.