Code execution via current-directory Perl module loading

Code execution in Debian duck before 0.10 allows local users to run arbitrary Perl code when duck starts in an attacker-controlled directory. At startup, duck lets Perl resolve required modules through the current working directory, so a same-named attacker file loads instead of the intended module. Exploitation requires write access to that directory and execution of duck there; injected code inherits the invoking user's privileges.