A flaw in the BINGOS Module::Load library allows for arbitrary module loading, which can be leveraged by an attacker to execute malicious code on the host system.

This is a vulnerability involving Improper Neutralization of Section Delimiters (CWE-145). Attackers who can influence the input strings passed to the load function can use "::" sequences to bypass intended directory restrictions and load arbitrary modules.

A CVSS score of 9.8 reflects the high potential for full system compromise. If an application relies on this library to handle user-supplied input for module loading, an attacker could achieve arbitrary code execution, resulting in complete breach of confidentiality, integrity, and availability.

Immediate Action: Upgrade to Module::Load version 0.22 or later. If using Perl v5.15.3 or earlier, ensure the module is manually updated; Perl versions after v5.15.4 include the fix.

Proactive Monitoring: Audit applications using Perl to identify if they utilize the Module::Load library and if inputs to the load function are properly sanitized.

Compensating Controls: Implement input validation to ensure that module names provided by users cannot contain path-traversal characters or unexpected delimiters.

Public Exploit Available: false

This is a long-standing vulnerability that has been assigned a current CVE record. Given the potential for remote code execution, developers and system administrators must ensure that all Perl environments are updated to versions that include the patched Module::Load library.