CVE-2026-14380: Arbitrary code execution via caller-influenced Profile attribute

High [CVE-2026-14380 +1] Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute

CVE-2026-19546Source published Aug 11, 2026Source updated Aug 11, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-94. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:65887, RHSA-2026:66179. Affected products named by the advisory: Red Hat package: perl-dbi.

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat package: perl-dbi

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

• perl-DBI-0:1.643-26.el10_2.4
• perl-DBI-0:1.643-9.el9_8.5
• RHSA-2026:65887
• RHSA-2026:66179

Mitigation guidance

• For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.

High [CVE-2026-14380] Arbitrary code execution via caller-influenced Profile attribute

CVE-2026-14380Source published Jul 7, 2026Source updated Jul 7, 2026

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands. The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Insights proxy 1.5

3 more entries in the full advisory.

Source-reported affected versions

• < 1.650

Source-reported fixed versions

• perl-DBI-0:1.643-26.el10_2.3
• perl-DBI:1.641-8100020260805130201.69ef70f8
• perl-DBI-0:1.641-2.el8_10
• perl-DBI-0:1.643-9.el9_8.3

6 more entries in the full advisory.

Mitigation guidance

• To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=>SPEC):db`, are not populated with unvalidated or untrusted input.