# CVE-2011-10043

## Summary

- **CVE ID:** CVE-2011-10043
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-145
- **Published:** Jul 7, 2026
- **Last Modified:** Jul 8, 2026

## Description

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.

Module names starting with "::" could be passed to the load function to specify arbitrary module paths.

Attackers able to influence module names passed to load could use that bug to execute arbitrary code.

## Affected Products

- BINGOS — Module::Load (0)

## References

- [CNA](https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html)
- [CNA](https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm)
- [CNA](https://metacpan.org/release/BINGOS/Module-Load-0.22/changes)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.78%
- **EPSS Percentile:** 53.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._