CVE-2026-95831

Name of the Vulnerable Software and Affected Versions Crypt::SelfCertificate versions 1.01 through 1.05

Description This software contains malware that executes Python code retrieved from an obfuscated URL. The generate certificate() function runs a Python script disguised as a certificate file, which uses base64 encoding to hide a hardcoded HTTP URL. The script retrieves and executes the response body directly, allowing arbitrary code to be invoked with the privileges of the user without saving a script to the host. In version 1.01, the dropper script is located in lib/Crypt/SelfCertificate/sample/validate.p12, and in version 1.05, it is found in lib/Crypt/SelfCertificate/sample/cert7.pem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.