CVE-2026-13048 GSHANK CVE debrief

Who should care

Organizations using Data::MuForm::Localizer versions through 0.05 for Perl should be aware of this vulnerability and take steps to patch or mitigate it to prevent potential code execution. This includes reviewing affected product deployments, applying patches or updates, and monitoring for suspicious activity related to message catalog loading. Additionally, security teams and vulnerability management teams should prioritize patching and verify the affected scope and severity of this vulnerability.

Technical summary

The Data::MuForm::Localizer module for Perl executes Perl code from a message catalog header, allowing for potential code execution. The issue arises from the load_lexicon function, which interpolates the language attribute into the catalog filename, permitting an attacker to load arbitrary .po files. An attacker can exploit this vulnerability by placing a malicious .po file at a readable path, allowing for code execution as the application user. This vulnerability can be mitigated by applying patches or updates to Data::MuForm::Localizer, restricting access to message catalog files, and monitoring for suspicious activity.

Defensive priority

Organizations using Data::MuForm::Localizer versions through 0.05 for Perl should prioritize patching to prevent potential code execution.

Recommended defensive actions

• Apply patches or updates to Data::MuForm::Localizer to prevent potential code execution.
• Restrict access to message catalog files to prevent loading of arbitrary .po files.
• Monitor for suspicious activity related to message catalog loading.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record indicates that Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, allowing for potential code execution. The issue arises from the load_lexicon function, which interpolates the language attribute into the catalog filename, permitting an attacker to load arbitrary .po files. To verify and mitigate this vulnerability, defenders should review the affected product deployments, check for suspicious activity related to message catalog loading, and apply patches or updates to Data::MuForm::Localizer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.