Spoon::Cookie in the Spoon module 0.24 for Perl does not properly use the Storable::thaw function which allows remote attackers to execute arbitrary code via a crafted request which is not properly handled when it is deserialized.