What is GHSA-gr3r-64v5-rf93?

GHSA-gr3r-64v5-rf93 is a security advisory published by GitHub Security Advisories with unknown severity. CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. ...

Which CVE IDs does GHSA-gr3r-64v5-rf93 cover?

GHSA-gr3r-64v5-rf93 covers the following CVE IDs: CVE-2026-118994. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-gr3r-64v5-rf93unknown

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. ...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-118994 →

📋 Description

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.

login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.

An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-118994
https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes
https://github.com/advisories/GHSA-gr3r-64v5-rf93