MetaCPAN (Organization): news timeline & CVEs

CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

Malicious Perl package IO::Socket::SSL::SelfCertificate 1.00 (CVE-2026-97230) executes Python from an obfuscated URL.

Robert Rothenberg reported that IO::Socket::SSL::SelfCertificate version 1.00 for Perl contains malware, tracked as CVE-2026-97230. The package executes Python code retrieved from an obfuscated URL. The distribution is listed on MetaCPAN. The oss-security post does not describe confirmed compromise of downstream users.

oss-securitySep 24, 23:00 UTC · 2d agoMalware 4 sources CVE-2026-97230

CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Catalyst::Seal before 0.03 can let one request bypass authorization on a later request (CVE-2026-85491).

Robert Rothenberg disclosed CVE-2026-85491 in the Perl module Catalyst::Seal. Versions before 0.03 allow one request to disable a path or route a later request past an authorization check. The cause is a dispatch memo keyed on the request path alone. The report references the MetaCPAN distribution; the post does not say the flaw is being exploited.

oss-securityupdated Sep 24, 22:58 UTC · 2d agofirst Sep 24, 22:23 UTC · 2d agoVulnerability 2 sources CVE-2026-85491

Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

CVE-2026-95831: malicious Crypt::SelfCertificate 1.01–1.05 runs Python from an obfuscated URL.

OSS-Security discussion of CVE-2026-95831 says Crypt::SelfCertificate versions 1.01 through 1.05 on CPAN contain malware. The malicious releases execute Python code retrieved from an obfuscated URL. MetaCPAN requirement and changelog pages were not loading, which a poster attributed to the distribution being yanked. The follow-up asked whether the module ever had a legitimate release.

oss-securityupdated Sep 24, 23:00 UTC · 2d agofirst Sep 23, 01:56 UTC · 4d agoMalware 4 sources CVE-2026-95831

CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Crypt::SelfCertificate 1.01–1.05 for Perl contains malware that runs Python from an obfuscated URL.

Robert Rothenberg reported on oss-security that Perl module Crypt::SelfCertificate versions 1.01 through 1.05 contain malware, tracked as CVE-2026-95831. The malicious code executes Python retrieved from an obfuscated URL. The affected distribution is listed on MetaCPAN. The post does not describe a separate exploitation campaign beyond the trojanized package.

oss-securityupdated Sep 24, 23:00 UTC · 2d agofirst Sep 22, 18:34 UTC · 4d agoMalware 4 sources CVE-2026-95831

MetaCPAN

Timeline4 articles

Related CVEsby mentions

Appears with

CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL