EUVD-2026-16957Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization.
GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. The client connects to remote hosts to execute code on them. A compromised or malicious remote host can execute arbitrary code back on the client through unsafe deserialization in the RPC protocol.
read_operation() in lib/GRID/Machine/Message.pm deserialises values from the remote side using eval()
$arg .= '$VAR1'; my $val = eval "no strict; $arg";
line 40-41
$arg is raw bytes from the protocol pipe. A compromised remote host can embed arbitrary perl in the Dumper-formatted response:
$VAR1 = do { system("..."); };
This executes on the client silently on every RPC call, as the return values remain correct.
This functionality is by design but the trust requirement for the remote host is not documented in the distribution.
AnalysisAI
Arbitrary Perl code execution in GRID::Machine through version 0.127 occurs when clients connect to remote hosts via RPC over SSH, as the client-side deserializer uses eval() on untrusted data from the remote peer without validation. A compromised or malicious remote host can inject arbitrary Perl code into Dumper-formatted responses that executes silently on the client during RPC calls, while maintaining correct return values to avoid detection. The vulnerability is design-inherent but the trust requirement for remote hosts is not documented, creating a security expectation mismatch for users.
Technical ContextAI
GRID::Machine is a Perl library that implements Remote Procedure Calls (RPC) over SSH, enabling clients to execute code on remote hosts. The root cause is unsafe deserialization in the read_operation() function within lib/GRID/Machine/Message.pm (CWE-502: Deserialization of Untrusted Data). The vulnerable code uses Perl's eval() function to deserialize responses from the remote side without sanitization or signature verification: the raw protocol bytes are prefixed with '$VAR1' and evaluated as arbitrary Perl code via eval "no strict; $arg". An attacker controlling a remote host can craft Dumper-formatted responses containing executable Perl statements (e.g., do { system("..."); };) that execute in the client's process context. The RPC architecture assumes the remote host is trusted, but this trust assumption is neither enforced nor clearly documented in the distribution, creating a critical security boundary violation when users connect to untrusted or compromised remote systems.
RemediationAI
Upgrade GRID::Machine to a version greater than 0.127 once a patched release is available from the maintainer (Casiano Rodriguez-Leon). Until a patch is released, do not use GRID::Machine to execute RPC calls to remote hosts outside your complete control; restrict GRID::Machine RPC connections to fully trusted, internally-managed systems only. If patching is delayed, implement network segmentation to ensure GRID::Machine clients can only reach pre-approved remote hosts and apply SSH host key verification and mutual TLS authentication at the transport layer to reduce the attack surface. Monitor the OSS-Security mailing list (https://www.openwall.com/lists/oss-security/2026/03/26/6) and CPAN for vendor updates. Additionally, request or contribute documentation updates to the GRID::Machine distribution clearly stating the requirement that all remote hosts must be fully trusted, and consider implementing optional message signing or HMAC-based authentication in future versions to enable use with partially-trusted peers.
Integer overflow in the Rust `grid` crate's `Grid::expand_rows()` method (versions 0.17.0 through 1.0.0) corrupts the re
An issue was discovered in Sylius products. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today