CVE-2026-66902

Received Received - Intake

Command Injection in Google::Auth Perl Module

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: CPANSec

Description

Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call. Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-66902

Affected Vendors & Products

Vendor	Product	Version / Range
google	auth	to 0.06 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Google::Auth versions before 0.06 for Perl. It allows execution of arbitrary commands via an external_account credentials JSON file. The Pluggable subclass reads a command from credential_source.executable.command in the JSON and runs it unsafely using system($command), which passes the whole string to /bin/sh -c. The command runs with the privileges of the application process.

Impact Analysis

Any application using Google::Auth before 0.06 that processes untrusted credentials files could execute arbitrary commands. Attackers with control over the credentials file could run malicious code on the system with the same permissions as the application.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. Uncontrolled command execution may result in data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update Google::Auth for Perl to version 0.06 or later to address the command injection vulnerability in external_account credentials handling.

Hi! I’m here to help you understand CVE-2026-66902. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70