---
id: CVE-2026-118995
title: >-
  CallBackery versions before 0.62.0 for Perl accept unintended values in form
  fields checked by createRxValidator
summary: >-
  CallBackery versions before 0.62.0 for Perl accept unintended values in form
  fields checked by createRxValidator.


  createRxValidator() is documented to anchor the supplied pattern at both ends,
  but builds /^${rx}$/ without grouping the p…
severity: none
cwe:
  - CWE-625
product: CallBackery
affected:
  - CallBackery < 0.62.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:10:38.972Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118995'
references:
  - url: 'https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes'
tags:
  - cve.org
epss: 0.00321
epssPercentile: 0.25273
ingestedAt: '2026-11-05T16:07:30.231Z'
---

## Overview

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator.

createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline.

An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.

## Affected

- `CallBackery < 0.62.0`

## Remediation

Upgrade to CallBackery 0.62.0 or later.