Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp...

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.

A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.

An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.