This removes code injection^[1] while simplifying the interface^[2]:

perl -e'use if 1, $ARGV[0]; print $ARGV[0]->VERSION' JSON::PP
[download]

1. Well, we're still allowing the user to load and execute a module, but it handles bad module names much better.
2. The input is specified once, and it avoids some traps.

UPDATE

Don't use this code, the correct $M is only visible inside the subprocess, hence the use has to happen inside.

FWIW: you don't need to export explicitly if you use this special bash syntax. Note the missing ;

~$ M="Data::Dumper" perl -M$M -E'say $ENV{M}->VERSION'
2.188
[download]

Edit

Furthermore, -M doesn't seem to throw an error for unknown modules.

So adding warnings -w to your execution will help you catch typos

~$ M="Data::Dumb" perl -M$M -wE'say $ENV{M}->VERSION'
Use of uninitialized value in say at -e line 1.
[download]

Furthermore, -M doesn't seem to throw an error for unknown modules.

Yes, it does:

perl -MNotRight -e 0
Can't locate NotRight.pm in @INC (you may need to install the NotRight
+ module) (@INC contains: ...
[download]

> Yes, it does:

Well obviously not for me and the code I posted!

update

the problem seems to be bash related, the -M$M doesn't expand the $M I've just set. But Perl's sub-process has the correct ENV.

Cheers Rolf
_{(addicted to the Perl Programming Language :)
see Wikisyntax for the Monastery}