Nixpkgs security tracker

Try the new UI
Login with GitHub

Details of issue NIXPKGS-2026-2692

NIXPKGS-2026-2692
published 10 hours ago
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
Permalink CVE-2026-78030
updated 10 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 20 hours ago
  • @LeSuisse ignored
    11 packages
    • libdbi
    • mmdbinspect
    • dbip-asn-lite
    • libdbiDrivers
    • dbip-city-lite
    • libdbi-drivers
    • perlPackages.DBI
    • dbip-country-lite
    • perl5Packages.DBIxClassSchemaLoader
    • perl5Packages.DBIxClassCursorCached
    • perlPackages.DBIxClassSchemaLoader
    1 day, 13 hours ago
  • @LeSuisse restored package perlPackages.DBI 1 day, 13 hours ago
  • @LeSuisse ignored
    65 packages
    • perl5Packages.DBIxSearchBuilder
    • luajitPackages.luadbi-postgresql
    • perlPackages.DBIxClassHTMLWidget
    • perl5Packages.DBIxClassHTMLWidget
    • perlPackages.DBIxClassCursorCached
    • perlPackages.CatalystModelDBICSchema
    • perlPackages.DBIxClassDynamicDefault
    • perl5Packages.CatalystModelDBICSchema
    • perl5Packages.DBIxClassDynamicDefault
    • gnomeExtensions.cryptogoldbitcoin-rate
    • perlPackages.DBIxClassIntrospectableM2M
    • perl5Packages.DBIxClassIntrospectableM2M
    • perlPackages.DBIxClassInflateColumnSerializer
    • perl5Packages.DBIxClassInflateColumnSerializer
    • perlPackages.CatalystAuthenticationStoreDBIxClass
    • perl5Packages.CatalystAuthenticationStoreDBIxClass
    • sbclPackages.dbi
    • libdbiDriversBase
    • perl5Packages.DBI
    • luaPackages.luadbi
    • libdbi-drivers-base
    • sbclPackages.cl-dbi
    • lua51Packages.luadbi
    • lua52Packages.luadbi
    • lua53Packages.luadbi
    • lua54Packages.luadbi
    • luajitPackages.luadbi
    • sbclPackages.dbi-test
    • perlPackages.DBIxClass
    • haskellPackages.FindBin
    • haskellPackages.monadbi
    • perl5Packages.DBIxClass
    • perlPackages.DBIxSimple
    • luaPackages.luadbi-mysql
    • perl5Packages.DBIxSimple
    • perlPackages.DBIxDBSchema
    • lua51Packages.luadbi-mysql
    • lua52Packages.luadbi-mysql
    • lua53Packages.luadbi-mysql
    • lua54Packages.luadbi-mysql
    • luaPackages.luadbi-sqlite3
    • perl5Packages.DBIxDBSchema
    • perlPackages.DBIxConnector
    • haskellPackages.OrderedBits
    • luajitPackages.luadbi-mysql
    • perl5Packages.DBIxConnector
    • perlPackages.DBIxClassCandy
    • lua51Packages.luadbi-sqlite3
    • lua52Packages.luadbi-sqlite3
    • lua53Packages.luadbi-sqlite3
    • lua54Packages.luadbi-sqlite3
    • perl5Packages.DBIxClassCandy
    • luaPackages.luadbi-postgresql
    • luajitPackages.luadbi-sqlite3
    • perlPackages.DBIxClassHelpers
    • perlPackages.DBIxIntrospector
    • perl5Packages.DBIxClassHelpers
    • perl5Packages.DBIxIntrospector
    • perlPackages.DBICxTestDatabase
    • perlPackages.DBIxSearchBuilder
    • lua51Packages.luadbi-postgresql
    • lua52Packages.luadbi-postgresql
    • lua53Packages.luadbi-postgresql
    • lua54Packages.luadbi-postgresql
    • perl5Packages.DBICxTestDatabase
    1 day, 13 hours ago
  • @LeSuisse accepted 1 day, 13 hours ago
  • @LeSuisse published on GitHub 10 hours ago
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm" my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.

Affected products

DBI
  • <1.653

Matching in nixpkgs

pkgs.perlPackages.DBI

Database independent interface for Perl

  • nixos-unstable -
    • nixos-unstable-small 1.653
  • nixos-26.05 -
    • nixos-26.05-small 1.648
Ignored packages (75)

pkgs.libdbi

DB independent interface to DB

  • nixos-unstable -
    • nixos-unstable-small 0.9.0
  • nixos-26.05 -
    • nixos-26.05-small 0.9.0

pkgs.mmdbinspect

Look up records for one or more IPs/networks in one or more .mmdb databases

  • nixos-unstable -
    • nixos-unstable-small 2.0.0
  • nixos-26.05 -
    • nixos-26.05-small 2.0.0

pkgs.dbip-asn-lite

Free IP to ASN Lite database by DB-IP

  • nixos-unstable -
  • nixos-26.05 -

pkgs.libdbiDrivers

Database drivers for libdbi

  • nixos-unstable -
    • nixos-unstable-small 0.9.0
  • nixos-26.05 -
    • nixos-26.05-small 0.9.0

pkgs.dbip-city-lite

Free IP to City Lite database by DB-IP

  • nixos-unstable -
  • nixos-26.05 -

pkgs.libdbi-drivers

Database drivers for libdbi

  • nixos-unstable -
    • nixos-unstable-small 0.9.0
  • nixos-26.05 -
    • nixos-26.05-small 0.9.0

pkgs.perl5Packages.DBI

Database independent interface for Perl

  • nixos-unstable -
    • nixos-unstable-small 1.653
  • nixos-26.05 -
    • nixos-26.05-small 1.648

pkgs.haskellPackages.monadbi

Extract underlying monads from monad transformers

  • nixos-unstable -
    • nixos-unstable-small 0.1
  • nixos-26.05 -
    • nixos-26.05-small 0.1

pkgs.perlPackages.DBIxSimple

Very complete easy-to-use OO interface to DBI

  • nixos-unstable -
    • nixos-unstable-small 1.37
  • nixos-26.05 -
    • nixos-26.05-small 1.37

pkgs.gnomeExtensions.cryptogoldbitcoin-rate

Shows Bitcoin rate in USDT on the panel and local fiat currencies in context menu. Crypto price providers: CoinGecko, Binance.US, Bitstamp, Gate.io, MEXC, Huobi, HitBTC, Bybit. Fiat conversion providers: CoinGecko, ExchangeRate, fawazahmed0, FloatRates, Frankfurter, WoXy-Sensei.

  • nixos-unstable -
    • nixos-unstable-small 13
  • nixos-26.05 -
    • nixos-26.05-small 13