CVE-2026-75031: Interchange vulnerability

What it is

In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe container which limits the scope of what it can do, unless the non-default AllowGlobal directive is configured for the catalog being accessed.CTOR]

Description quoted from the CVE record (assigned by redhat-cnalr, published 2026-09-18).

Weakness: CWE-94: Improper Control of Generation of Code (‘Code Injection’)

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 8 references on Exploit Observer

Live scores

EPSS

0.007
low predicted chance of attack

VEDAS

0.989
strong exploit evidence

On CISA KEV

Not listed

Detection rule

Nuclei · Suricata

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

• https://www.interchangecommerce.org/i/dev/news?mv_arg=00071 (vendor-advisory)
• https://github.com/interchange/interchange/commit/65b6ea9d3761dd1fd2071c962819562afa335e4e (patch)

How to detect it

Nuclei template (active check)

Interchange - Unauthenticated Perl Code Injection via quick_question

Interchange (interchange/interchange) contains a remote code execution vulnerability in the “quick question” admin page (dist/lib/UI/pages/admin/quick_question.html). In default installations the page lacked a super-user guard, and the user-supplied CGI parameters (no, yes) were placed into a [calc] block whose result is reparsed as Interchange Tag Language. An unauthenticated attacker can embed a [perl]...[/perl] tag in the “no” parameter, causing attacker-controlled Perl to execute server-side and its return value to be reflected in the response. The Perl runs inside a Safe compartment by default (full OS command execution additionally requires the non-default AllowGlobal directive). Fixed in commit 65b6ea9 which wraps the page in [if-mm super] and sets reparse=0.

Name and description quoted from the template, written by VEDAS.

The template sends 2 requests (GET /cgi-bin/catalog/admin/quick_question?no=%5Bperl%5Dreturn%20%27veda..., GET /admin/quick_question?no=%5Bperl%5Dreturn%20%27vedasINJ%27%20.%20%2...); it decides using status, word matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2026-75031.yaml

id: CVE-2026-75031

info:
  name: "Interchange - Unauthenticated Perl Code Injection via quick_question"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Interchange (interchange/interchange) contains a remote code execution vulnerability in the "quick question"
    admin page (dist/lib/UI/pages/admin/quick_question.html). In default installations the page lacked a super-user
    guard, and the user-supplied CGI parameters (no, yes) were placed into a [calc] block whose result is reparsed
    as Interchange Tag Language. An unauthenticated attacker can embed a [perl]...[/perl] tag in the "no" parameter,
    causing attacker-controlled Perl to execute server-side and its return value to be reflected in the response.
    The Perl runs inside a Safe compartment by default (full OS command execution additionally requires the
    non-default AllowGlobal directive). Fixed in commit 65b6ea9 which wraps the page in [if-mm super] and sets
    reparse=0.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-75031&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=interchange&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-75031
    cwe-id: CWE-94
  metadata:
    verified: false
    max-request: 2
  tags: cve,cve2026,interchange,rce,code-injection,perl,unauth

http:
  - raw:
      - |
        GET /cgi-bin/catalog/admin/quick_question?no=%5Bperl%5Dreturn%20%27vedasINJ%27%20.%20%2813%2A7%29%5B%2Fperl%5D HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /admin/quick_question?no=%5Bperl%5Dreturn%20%27vedasINJ%27%20.%20%2813%2A7%29%5B%2Fperl%5D HTTP/1.1
        Host: {{Hostname}}
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "vedasINJ91"
      - type: status
        status:
          - 200

CVE-2026-75031.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-75031 Interchange - Unauthenticated Perl Code Injection via quick_question Attempt. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-75031 Interchange - Unauthenticated Perl Code Injection via quick_question Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:"/admin/quick_question"; nocase; fast_pattern; content:"perl"; nocase; distance:0; pcre:"/quick_question\?[^ ]*(%5[bB]perl%5[dD]|\x5bperl\x5d)/i"; classtype:web-application-attack; reference:cve,CVE-2026-75031; reference:url,https://www.exploit.observer/?keyword=CVE-2026-75031&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=interchange&match=exact; sid:1053800; rev:1;)

CVE-2026-75031.rules on GitHub

References

Vendor advisories and patches

• https://www.interchangecommerce.org/i/dev/news?mv_arg=00071 (vendor-advisory)
• https://github.com/interchange/interchange/commit/65b6ea9d3761dd1fd2071c962819562afa335e4e (patch)

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.