CVE-2026-97230 in IO::Socket::SSL::SelfCertificate
Summary
by MITRE • 09/25/2026
IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.
The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.
The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.
The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.
The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.
This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.
The SHA-256 digests of the files are
ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem
d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Perl module IO::Socket::SSL::SelfCertificate version 1.00 represents a severe supply chain compromise where malicious code is embedded directly within the distribution archive under the guise of legitimate certificate files. This incident involves an attacker or compromised maintainer injecting malware that executes Python scripts via an obfuscated mechanism, effectively turning a standard SSL utility module into a vector for remote code execution. The core technical flaw lies in the generate_certificate function, which is designed to create self-signed certificates but has been altered to execute arbitrary system commands. Specifically, when this function is invoked during normal usage of the library, it triggers the processing of a file located at lib/Crypt/SelfCertificate/sample/cert.pem. This file contains Python code that acts as a dropper or loader, attempting to retrieve additional malicious payloads from a hardcoded HTTP URL. The retrieved content is base64 encoded and then executed directly in memory, allowing for stealthy operation without leaving persistent script files on the victim's host system after execution completes.
From an operational perspective, this vulnerability allows for arbitrary code execution with the privileges of the user running the Perl application that utilizes IO::Socket::SSL::SelfCertificate. Because the payload is fetched over HTTP and executed directly from memory, it bypasses many traditional file-based detection mechanisms. The absence of test scripts or build hooks in the releases suggests a deliberate attempt to evade automated quality assurance processes that might otherwise detect anomalous behavior during installation or compilation phases. This indicates premeditated malicious intent rather than accidental code corruption. The impact is significant for any organization relying on this specific version of the module, as it compromises the integrity of SSL/TLS operations and potentially provides an attacker with a foothold within the system environment through the execution context of the application user.
This incident aligns closely with known attack patterns documented in industry standards such as CWE-829 for Inclusion of Functionality from Untrusted Control Sector, where functionality is added to a product by untrusted sources without proper verification. Furthermore, the behavior mirrors techniques described in MITRE ATT&CK framework under T1059 Command and Scripting Interpreter, specifically involving Python execution, and potentially T1105 Ingress Tool Transfer if the remote URL retrieval is considered part of the initial access or resource deployment phase. The similarity to CVE-2026-95831 affecting Crypt::SelfCertificate highlights a broader trend where related modules within the Perl ecosystem are targeted through similar obfuscation and execution techniques, suggesting coordinated campaigns against specific library dependencies used in web security contexts.
Mitigation strategies must prioritize immediate removal of the affected version from all production environments. Organizations should audit their dependency trees for IO-Socket-SSL::SelfCertificate versions 1.00 and upgrade to a verified clean release or replace it with an alternative, well-maintained SSL certificate generation library that does not exhibit such behaviors. It is critical to verify the integrity of installed modules using cryptographic hashes; the SHA-256 digest ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 for IO-Socket-SSL-SelfCertificate-1.00.tar.gz should be flagged as malicious and blocked at the package management level. Additionally, network security controls such as firewalls or proxy servers should be configured to block outbound connections to the hardcoded obfuscated URLs associated with this payload to prevent successful retrieval of secondary stages even if execution is attempted. Security teams must also monitor for unusual Python process spawns originating from Perl applications, particularly those involving base64 decoding and immediate execution patterns indicative of this specific malware family.