The Crypt::SelfCertificate Perl module, versions 1.01 through 1.05, contains embedded malware that executes a Python script downloaded from a hard‑coded HTTP URL. The URL is obfuscated via base64 encoding, and the script is run as the current user without being written to disk. This allows arbitrary code execution with the privileges of the user running the module, presenting a severe compromise risk. The vulnerability is a form of malware delivery and execution, categorized under CWE-506.

The affected product is the Crypt::SelfCertificate module for the Perl programming language, distributed through CPAN. Versions 1.01 through 1.05 (inclusive) are impacted, with malicious payload files located in lib/Crypt/SelfCertificate/sample/validate.p12 for version 1.01 and lib/Crypt/SelfCertificate/sample/cert7.pem for version 1.05. Systems that have installed any of these versions from the provided tarballs are at risk.

Because the payload is launched when the generate_certificate function is called, any user invoking this function—directly from a Perl script or indirectly within an application—can trigger the remote code download and execution. No additional privileges or network exposure beyond the hard‑coded HTTP request are necessary. The CVSS score for the vulnerability is 7.8, indicating a high level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the absence of a patch and the nature of the threat make the risk high. Investigators should consider the environment potentially compromised immediately upon installation of the affected package.