Data::MuForm::Localizer up to 0.05 Message Catalog Loader Localizer.pm extract_header_msgstr lang os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in Data::MuForm::Localizer up to 0.05. Affected is the function Data::MuForm::Localizer::load_lexicon/Data::MuForm::Localizer::extract_header_msgstr of the file Localizer.pm of the component Message Catalog Loader. The manipulation of the argument lang leads to os command injection. This vulnerability is listed as CVE-2026-13048. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Data::MuForm::Localizer up to 0.05. It has been rated as critical. This issue affects the function Data::MuForm::Localizer::load_lexicon/Data::MuForm::Localizer::extract_header_msgstr of the file Localizer.pm of the component Message Catalog Loader. The manipulation of the argument lang with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename. load_lexicon builds the catalog path by appending `Messages/$lang.po` to the directory holding Localizer.pm, where $lang is the language attribute, with no check that it names a bare locale tag. A value holding `../` segments walks out of the message directory, so any readable path with a `.po` suffix is loaded. While parsing the catalog, extract_header_msgstr takes the `Plural-Forms:` header, prefixes `$` to the bare words nplurals, plural and n, and passes the rest verbatim into a string that is evaluated: the nplurals form evaluates the header expression immediately, and the plural_code form compiles it into a subroutine whose body runs when a plural message is localized. A header of `nplurals=2; plural=(system('...'),0);` therefore runs that command as the catalog loads. The evaluation inherits strict, so an expression that assigns to an undeclared variable fails to compile, while one built from calls alone does not. An application that sets the language attribute from request data, an Accept-Language header or a locale parameter, and an attacker who can place a file with a `.po` suffix and chosen contents at a readable path, together give code execution as the application user. The message expansion path is not affected: expand_named substitutes only the placeholder names the caller supplies, and _mangle_value returns the value unchanged.

It is possible to read the advisory at security.metacpan.org. The identification of this vulnerability is CVE-2026-13048 since 06/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/13/2026). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Data::MuForm::Localizer

Version

• 0.05

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion