CVE-2011-10043 Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded
Attackers can execute arbitrary code by passing malicious module names to the load function in vulnerable Perl Module::Load versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-10043?
CVE-2011-10043 is a critical code injection vulnerability in BINGOS Module::Load, published on 7 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.
Module names starting with "::" could be passed to the load function to specify arbitrary module paths.
Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
Weakness: CWE-145
Which versions are affected by CVE-2011-10043?
How do I fix CVE-2011-10043?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2011-10043 being exploited?
There is no known exploitation of CVE-2011-10043 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2011-10043, GHSA-8x3h-9qcg-hv3j, UBUNTU-CVE-2011-10043.