OS command injection in Google::Auth for Perl via credentials JSON (CVE-2026-66902)

Google::Auth versions before 0.06 for Perl execute an arbitrary command specified in an external_account credentials JSON file through an ungated `system($command)` call. The Pluggable subclass reads `credential_source.executable.command` from the JSON and passes it directly to `/bin/sh -c`, after copying the JSON-supplied `environment_variables` into the process environment. Any application that builds credentials from a configuration it does not fully control will execute the embedded command with the privileges of the application process. Affected versions: - before 0.06 We recommend updating to: 0.06. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/435 Details: https://vuln.today/cve/CVE-2026-66902