CVE-2026-95831

Versions 1.01 through 1.05 of the Perl CPAN distribution Crypt::SelfCertificate contain embedded malicious code (CWE-506) rather than a conventional software flaw. The module's generate_certificate function executes a Python script that ships disguised as a sample certificate file (lib/Crypt/SelfCertificate/sample/validate.p12 in 1.01, sample/cert7.pem in 1.05). That script decodes a base64-obfuscated, hardcoded HTTP URL, downloads whatever the server returns, and executes the response body directly, giving the attacker fileless arbitrary code execution with the privileges of the user who invoked the module. Anyone who installed these versions and called generate_certificate should assume attacker-controlled code may have run on their host. No CVSS score has been assigned, the issue is not on the CISA KEV list, and no public PoC or confirmed victim executions have been reported, though the malicious payload was distributed through the module's releases.

What to do: Uninstall Crypt::SelfCertificate 1.01–1.05 from all systems and replace it with a trusted, actively maintained certificate module or direct OpenSSL tooling. Treat any host that called generate_certificate with an affected version as potentially compromised: check for the advisory's SHA-256 hashes (e.g., Crypt-SelfCertificate-1.01.tar.gz fbff21f4..., Crypt-SelfCertificate-1.05.tar.gz 9fdfa7d6..., and the identical sample-file digest 27b2d2d3...), review egress logs for outbound HTTP connections to unfamiliar URLs, and rotate credentials used on those machines. Never open or execute the bundled sample files validate.p12 or cert7.pem.