[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7122d4c997ade5699222f5f6c66ac8f3@riseup.net>
Date: Thu, 26 Mar 2026 18:43:43 +0000
From: piedcrow@...eup.net
To: oss-security@...ts.openwall.com
Subject: CVE-2026-4851: remote-to-local code execution in GRID::Machine
Affects: GRID::Machine
Versions: 0.127 verified, likely all released versions affected.
URL: https://cpan.org/authors/id/C/CA/CASIANO/GRID-Machine-0.127.tar.gz
Description:
GRID::Machine is a module for the Perl programming language that
implements Remote Procedure Calls (RPC) over SSH.
The module has a security flaw that allows an untrusted remote to
execute arbitrary code on the client.
The subroutine read_operation() in lib/GRID/Machine/Message.pm
deserializes values from the remote side using eval():
my $val = eval "no strict; $arg"; # line 40
...where $arg is raw bytes sent from the remote over the protocol
pipe. A compromised remote host can embed arbitrary Perl code in the
response. Exploitation can occur silently, without the local side
failing and an error being visible to a user.
Proof-of-concept exploit code exists.
CPANSec has assigned CVE-2026-4851 to this issue.
Weaknesses:
CWE-94: Improper Control of Generation of Code ('Code Injection').
CWE-502: Deserialization of Untrusted Data.
Mitigation:
None. GRID::Machine should not be used with untrusted remotes.
Solution:
None, no upstream fix to be provided.
Timeline:
2026-03-24: Vulnerability reported to module author and CPANSec.
2026-03-25: First contact with author.
2026-03-25: CVE-2026-4851 assigned by CPANSec.
2026-03-26: Author indicates no fix will be provided.
2026-03-26: CPANSec advises for disclosure.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
