It's vulnerable because the user controls the content of $userinput, the variable name doesn't matter. Real code would look like this: #!/usr/bin/perl pri

It's vulnerable because the user controls the content of $userinput, the variable name doesn't matter. Real code would look like this: #!/usr/bin/perl print "Enter filename: "; $filename = <STDIN>; open(file_handler, "$filename"); If you see this code, you know that you can execute any command by giving it at the filename prompt and appending a '|' character. For example giving cat /etc/passwd |zenity --text-info | will popup a dialog with the content of /etc/passwd.