Skip to content
Fencer Intel
high 7.8

CVE-2021-36770 json

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in…

published 5y ago modified 4mo ago also EUVD-2021-23358

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Patch / fix

  • p5-encode_project p5-encode 3.12
  • perl Debian 14, Debian 13, Debian 12 5.32.1-5
  • libencode-perl Debian 14, Debian 13, Debian 12 3.08-2

debian advisories DEBIAN-CVE-2021-36770

  • perl Ubuntu 22.04 LTS 5.32.1-3ubuntu3

ubuntu advisories UBUNTU-CVE-2021-36770

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 5.34.0-r1
  • perl-encode Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 3.12-r0

alpine advisories ALPINE-CVE-2021-36770

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2021-36770 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-36770 updated cvss 7.8

perl-Encode: bug in local configuration loading allows arbitrary Perl code execution placed under the current working directory

  • Red Hat Enterprise Linux 7 perl-Encode Red Hat Enterprise Linux 8 perl-Encode, perl-encoding Red Hat Enterprise Linux 9 perl-Encode, perl-encoding Red Hat Software Collections rh-perl526-perl-Encode, rh-perl530-perl-Encode, rh-perl526-perl-encoding, rh-perl530-perl-encoding
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-427 Uncontrolled Search Path Element

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.