What is CVE-2012-6329?

CVE-2012-6329 is a vulnerability in Perl, classified under Code Injection. Published 2013-01-04.

Is CVE-2012-6329 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Perl

CVE-2012-6329

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.

Vulnerability class: RCE (Remote Code Execution)

Published 2013-01-04 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.637 (99.2th percentile), scored 2026-10-18.

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.635 · newest: 0.637 · change: +0.002

Affected products

Perl — versions 5.10, 5.10.0, 5.10.1

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2012-6329?: CVE-2012-6329 is a vulnerability in Perl, classified under Code Injection. Published 2013-01-04.
Is CVE-2012-6329 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.