It was reported that the perl Module::Metadata module incorrectly claimed that it would gather metadata about a .pm file without executing unsafe code.  However, when Module::Metadata determines the version of a module, it can extract a small amount of code (if present in the $Version variable assignment) and evaluates it, which can lead to the execution of arbitrary code (the same code that module would execute to obtain the value of $Version).

This behaviour is intended and known by the authors of the module, the only issue here is with the claim of "without executing unsafe code" and with not making this behaviour clearer in the documentation.  The authors intend to remove this mis-statement and properly document this intended behaviour.


Acknowledgements:

Red Hat would like to thank the Perl 5 Security Team for reporting this issue.