CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "modules": [
      "Data::MuForm::Localizer"
    ],
    "packageName": "Data-MuForm",
    "packageURL": "pkg:cpan/Data-MuForm",
    "programFiles": [
      "lib/Data/MuForm/Localizer.pm"
    ],
    "programRoutines": [
      {
        "name": "Data::MuForm::Localizer::load_lexicon"
      },
      {
        "name": "Data::MuForm::Localizer::extract_header_msgstr"
      },
      {
        "name": "Data::MuForm::Localizer::get_lexicon"
      }
    ],
    "repo": "https://github.com/gshank/data-muform",
    "versions": [
      {
        "lessThanOrEqual": "0.05",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]