CVE-2026-97230

Received Received - Intake

Malware in IO::Socket::SSL::SelfCertificate Perl Module

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: CPANSec

Description

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly. The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host. The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation. The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem. This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate. The SHA-256 digests of the files are ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-97230

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-506	The product contains code that appears to be malicious in nature.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Perl module IO::Socket::SSL::SelfCertificate version 1.00, which contains malware. The malware executes Python code fetched from an obfuscated URL during certificate generation. The Python script is saved as a certificate file and retrieves additional code from a hardcoded HTTP URL using base64 obfuscation, then runs the retrieved code directly.

Detection Guidance

Check for the presence of the malicious file at the path lib/Crypt/SelfCertificate/sample/cert.pem in the IO::Socket::SSL::SelfCertificate package. Verify the SHA-256 hash of the file against the provided hash 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac.

Impact Analysis

This vulnerability allows arbitrary code execution on your system as the current user without saving a script file. The malicious code is downloaded and executed directly from memory, making it harder to detect. It could lead to unauthorized access, data theft, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using this module may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Remove the IO::Socket::SSL::SelfCertificate package version 1.00 from your system. Do not install or use this version. Check for any unusual network activity or unauthorized code execution as the payload may be triggered after installation.

Hi! I’m here to help you understand CVE-2026-97230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70