Crypt::SelfCertificate CVE-2026-95831

Exploitation requires the victim to install the malicious Crypt::SelfCertificate package (versions 1.01 through 1.05) from CPAN and then call the generate_certificate function - this is the trigger, since the releases contain no test scripts or build hooks that would fire at install time. The dropper (saved as lib/Crypt/SelfCertificate/sample/validate.p12 in 1.01 or cert7.pem in 1.05) additionally requires outbound HTTP egress to reach the hardcoded, base64-obfuscated URL and for that server to still serve payload code. Limiting factors: local attack vector (AV:L), mandatory user action of running the module (UI:R), the module's obscurity/tiny install base, and dependence on network access plus a live attacker endpoint; code runs only with the privileges of the invoking user.

This is a genuine, high-priority supply-chain compromise rather than an inflated CVSS score. Unlike a coding flaw, CVE-2026-95831 is intentional embedded malware (CWE-506): Crypt::SelfCertificate 1.01-1.05 is a trojanized CPAN package whose generate_certificate function drops a Python script (disguised as a certificate file) that base64-deobfuscates a hardcoded http URL, fetches remote code, and executes it in-memory as the invoking user - fileless, with no dropped script persisted. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) is consistent with the description: exploitation is local, requires the victim to install and run the module (UI:R), needs no prior authentication (PR:N), and yields full C/I/A compromise. No EPSS score, no CISA KEV listing, and no independent proof-of-concept exploit are provided; note that for malicious-package cases the 'exploit' IS the shipped payload, so absence of separate POC/EPSS/KEV signals does not lower real risk. The main risk-limiting factors are that the package is obscure (small install base) and that the payload depends on the attacker's hardcoded http URL still serving code and on outbound network egress being permitted. No signal conflicts with the description; the local attack vector and required user action are the primary mitigants, not the impact magnitude.

A developer installs Crypt::SelfCertificate 1.01-1.05 from CPAN and calls generate_certificate to create a self-signed certificate. The function instead writes and runs a bundled Python dropper that decodes a base64-obfuscated http URL, downloads attacker-controlled code, and executes it in memory as the current user with no file artifact left behind. No separate public exploit is needed because the malicious payload ships inside the package itself.