Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
CPAN removed Crypt::SelfCertificate 1.01–1.05 after CVE-2026-95831 identified a Python dropper.
CVE-2026-95831 covers Crypt::SelfCertificate versions 1.01 through 1.05 on CPAN, which contain malware that executes Python code retrieved from an obfuscated URL. Robert Rothenberg said every affected version has been removed, although copies may remain on independent mirrors, and that no reverse dependencies are known. Version 1.00 did not include the dropper but did not work properly and may have served as staging for an upgrade. CPANSec is still investigating.
- CVE-2026-95831 covers versions 1.01 through 1.05
- Malware executes Python fetched from an obfuscated URL
- Affected releases were removed; mirrors may still have copies
- No reverse dependencies are currently known
Vulnerabilities mentionedAll →
- CVE-2026-958317.8—Embedded Malware in Perl CPAN Module Crypt::SelfCertificate 1.01–1.05published · CPAN (Perl distribution, author unattributed in advisory) Crypt::SelfCertificate
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-95831 | Embedded Malware in Perl CPAN Module Crypt::SelfCertificate 1.01–1.05 Versions 1.01 through 1.05 of the Perl CPAN distribution Crypt::SelfCertificate contain embedded malicious code (CWE-506) rather than a conventional software flaw. The module's generate_certificate function executes a Python script that ships disguised as a sample certificate file (lib/Crypt/SelfCertificate/sample/validate.p12 in 1.01, sample/cert7.pem in 1.05). That script decodes a base64-obfuscated, hardcoded HTTP URL, downloads whatever the server returns, and executes the response body directly, giving the attacker fileless arbitrary code execution with the privileges of the user who invoked the module. Anyone who installed these versions and called generate_certificate should assume attacker-controlled code may have run on their host. No CVSS score has been assigned, the issue is not on the CISA KEV list, and no public PoC or confirmed victim executions have been reported, though the malicious payload was distributed through the module's releases. |
Posted by Robert Rothenberg on Sep 23 We are not aware of reverse dependencies. Yes, all versions have been removed, however they may exist on independent mirrors. 1.00 did not have the dropper, but does not appear to have worked properly. It may have functioned as staging so that an upgrade would have installed the dropper. CPANSec are still investigating.
This source does not provide full text. Read it at seclists.org.