CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
Crypt::SelfCertificate 1.01–1.05 for Perl contains malware that runs Python from an obfuscated URL.
Robert Rothenberg reported on oss-security that Perl module Crypt::SelfCertificate versions 1.01 through 1.05 contain malware, tracked as CVE-2026-95831. The malicious code executes Python retrieved from an obfuscated URL. The affected distribution is listed on MetaCPAN. The post does not describe a separate exploitation campaign beyond the trojanized package.
- Crypt::SelfCertificate 1.01 through 1.05 are malicious
- Payload executes Python code taken from an obfuscated URL
- Issue is tracked as CVE-2026-95831 on MetaCPAN
- CVEs
- CVE-2026-95831
- ATT&CK
- T1059.006 Command and Scripting Interpreter: PythonT1105 Ingress Tool TransferT1027 Obfuscated Files or Information
- Products
- Crypt::SelfCertificatePerl
- Organizations
- MetaCPAN
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95831 | Embedded Malware in Perl CPAN Module Crypt::SelfCertificate 1.01–1.05 | 7.8 | — |
From the original article
Posted by Robert Rothenberg on Sep 22 ======================================================================== https://metacpan. org/dist/Crypt-SelfCertificate...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.