Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.
A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.
An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.
For deployments that cannot upgrade to 3.00, which requires Perl 5.18 and a C compiler, do not restore dumps that contain Regexps compiled from untrusted input.
Upgrade to Data-Dump-Streamer 3.00 or later.