If a template is provided to Perl's Template Toolkit, can you ensure that the code generation inside Template Toolkit is sufficiently subsetted to be safe?

1 Answer 1


No, Template Toolkit suffers from multiple different ways to arbitrarily execute code, like this one used in CVE-2019-1978

[% template.new({ 'BLOCK' => 'use Data::Dumper; print STDERR Dumper(\%ENV); die' }) %] 

Do not trust user-provided templates. This bug is filed upstream here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .