Description
IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.

The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.

The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.

The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.

The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.

This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.

The SHA-256 digests of the files are

ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz
821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem

d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz
Published: 2026-09-24
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Investigate
AI Analysis

Impact

The vulnerability exists in IO::Socket::SSL::SelfCertificate version 1.00 for Perl, where a certificate file contains an embedded Python script. During certificate generation or usage, the script is executed without leaving a separate file on disk, fetching code from a hard‑coded, base64‑obfuscated HTTP URL. The result is arbitrary code execution as the local user, and the weakness corresponds to CWE‑506.

Affected Systems

This issue affects any system that has installed IO::Socket::SSL::SelfCertificate version 1.00 from CPAN. No other versions or products are reported to be affected.

Risk and Exploitability

The EPSS score is < 1%, indicating a very low exploitation probability, while the CVSS score of 9.8 indicates critical severity. The vulnerability is not listed in the CISA KEV catalog. The attack vector inferred is local installation or execution of the module, meaning that any attacker who can install or influence the module can run arbitrary code. The impact is severe, but no public exploitation has been documented. Immediate assessment of affected systems is warranted.

Generated by OpenCVE AI on September 26, 2026 at 00:10 UTC.

Remediation

Vendor Solution

Systems on which the affected package was installed should be considered potentially compromised and investigated accordingly.

OpenCVE Recommended Actions

  • Remove IO::Socket::SSL::SelfCertificate version 1.00 from any host and replace it with a trusted, unmodified version if necessary.
  • Consider the host compromised and execute a thorough security investigation to detect any post‑compromise artifacts.
  • Apply the vendor’s recommended patch or update to a later CPAN release that removes the malicious payload.

Generated by OpenCVE AI on September 26, 2026 at 00:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Perl
Perl io::socket::ssl::selfcertificate
Vendors & Products Perl
Perl io::socket::ssl::selfcertificate

Sat, 26 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 24 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
Description IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly. The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host. The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation. The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem. This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate. The SHA-256 digests of the files are ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz
Title IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL
Weaknesses CWE-506
References

Subscriptions

Perl Io::socket::ssl::selfcertificate
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-09-25T16:11:11.028Z

Reserved: 2026-09-24T10:09:37.672Z

Link: CVE-2026-97230

cve-icon Vulnrichment

Updated: 2026-09-25T16:10:50.736Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T23:19:22.960

Modified: 2026-09-25T17:17:20.880

Link: CVE-2026-97230

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T19:43:08Z

Weaknesses