CVE-2021-36770

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

• CWE-427

• https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9Patch, Third Party Advisory
• https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NDGQSGMEZ75FJGBKNYC75OTO7TF7XHB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KOZYD7BH2DNIAEZ2ZL4PJ4QUVQI6Y33/
• https://metacpan.org/dist/Encode/changesThird Party Advisory
• https://news.cpanel.com/unscheduled-tsr-10-august-2021/Third Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36770Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210909-0003/Third Party Advisory
• https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9Patch, Third Party Advisory
• https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NDGQSGMEZ75FJGBKNYC75OTO7TF7XHB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KOZYD7BH2DNIAEZ2ZL4PJ4QUVQI6Y33/
• https://metacpan.org/dist/Encode/changesThird Party Advisory
• https://news.cpanel.com/unscheduled-tsr-10-august-2021/Third Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36770Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210909-0003/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20241108-0002/

Published

Aug 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36764In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Poin…7.5
• CVE-2021-36765In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP r…7.5
• CVE-2021-36766Concrete5 through 8.5.5 deserializes Untrusted Data. The vul…7.2
• CVE-2021-36767In Digi RealPort through 4.10.490, authentication relies on …9.8
• CVE-2021-36769A reordering issue exists in Telegram before 7.8.1 for Andro…5.3
• CVE-2021-3677A flaw was found in postgresql. A purpose-crafted query can …6.5
• CVE-2021-36771Zoho ManageEngine ADManager Plus before 7110 allows reflecte…6.1
• CVE-2021-36772Zoho ManageEngine ADManager Plus before 7110 allows stored X…6.1
• CVE-2021-36773uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support…7.5
• CVE-2021-36774Apache Kylin allows users to read data from other database s…6.5
• CVE-2021-36775a Improper Access Control vulnerability in SUSE Rancher allo…8.8
• CVE-2021-36776A Improper Access Control vulnerability in SUSE Rancher allo…8.8