CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
Crypt::SelfCertificate 1.01–1.05 for Perl contains malware that runs Python from an obfuscated URL.
Robert Rothenberg reported on oss-security that Perl module Crypt::SelfCertificate versions 1.01 through 1.05 contain malware, tracked as CVE-2026-95831. The malicious code executes Python retrieved from an obfuscated URL. The affected distribution is listed on MetaCPAN. The post does not describe a separate exploitation campaign beyond the trojanized package.
- Crypt::SelfCertificate 1.01 through 1.05 are malicious
- Payload executes Python code taken from an obfuscated URL
- Issue is tracked as CVE-2026-95831 on MetaCPAN
Vulnerabilities mentionedAll →
- CVE-2026-958317.8—Embedded Malware in Perl CPAN Module Crypt::SelfCertificate 1.01–1.05published · CPAN (Perl distribution, author unattributed in advisory) Crypt::SelfCertificate
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-95831 | Embedded Malware in Perl CPAN Module Crypt::SelfCertificate 1.01–1.05 Versions 1.01 through 1.05 of the Perl CPAN distribution Crypt::SelfCertificate contain embedded malicious code (CWE-506) rather than a conventional software flaw. The module's generate_certificate function executes a Python script that ships disguised as a sample certificate file (lib/Crypt/SelfCertificate/sample/validate.p12 in 1.01, sample/cert7.pem in 1.05). That script decodes a base64-obfuscated, hardcoded HTTP URL, downloads whatever the server returns, and executes the response body directly, giving the attacker fileless arbitrary code execution with the privileges of the user who invoked the module. Anyone who installed these versions and called generate_certificate should assume attacker-controlled code may have run on their host. No CVSS score has been assigned, the issue is not on the CISA KEV list, and no public PoC or confirmed victim executions have been reported, though the malicious payload was distributed through the module's releases. |
Posted by Robert Rothenberg on Sep 22 ======================================================================== https://metacpan.org/dist/Crypt-SelfCertificate...
This source does not provide full text. Read it at seclists.org.