GRID::Machine, a Perl library that provides remote procedure calls over SSH, deserializes data from the remote side using eval without strictness checks. The binary payload from the RPC protocol is concatenated into a string and evaluated, allowing an attacker who controls or compromises the remote host to inject arbitrary Perl code, such as system calls, that executes silently on the client. This results in full code execution on the client with the permissions of the running user, potentially compromising confidentiality, integrity, and availability of the client system.

The vulnerability affects all releases of CASIANO’s GRID::Machine for Perl up to and including version 0.127. In these versions the RPC interface accepts responses from any remote host without authentication or validation, meaning that any machine the client trusts and connects to could trigger the payload.

With a CVSS score of 9.8 the flaw is a critical remote code execution vulnerability. Although the EPSS score is below 1 per cent and the issue is not listed in the CISA KEV catalog, the lack of a patch means the attack surface remains open. In practice an attacker must possess or compromise a remote host that the client connects to via the RPC mechanism; once that condition is met, the expluatation path is straightforward through the unsafe eval. Until mitigation is applied the risk to all affected installations is high and the impact could be total system compromise.