Shell command execution via unsafe open and eval

Command injection in Module::ScanDeps before 1.36 allows local users to execute arbitrary shell commands through crafted scan input. The scan_file routine uses Perl's two-argument open on an untrusted filename, treating a trailing pipe as a command, while other paths evaluate untrusted strings. Root execution requires needrestart to invoke the library while scanning an attacker-controlled Perl process; the library flaw alone runs with the caller's privileges.