CVE-2026-126673

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in dumpqr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@ ... " and "$\ ... " in the pattern run as code when the dump is evaluated. An already escaped delimit...