IO::Socket::SSL::SelfCertificate EUVD-2026-86479

Requires the victim to install the specific malicious release IO-Socket-SSL-SelfCertificate-1.00 from CPAN AND to invoke generate_certificate(); the advisory explicitly notes there are no test scripts or build hooks, so the payload does NOT run automatically at install time and must be manually triggered. It further requires outbound HTTP egress to reach the hardcoded, base64-obfuscated C2 URL for the payload to be retrieved and executed. Limiting factors: victim must both install and call the function, the package is a v1.00 malicious upload likely removed from CPAN quickly, and blocked/proxied outbound HTTP would prevent payload retrieval.

This is not a conventional exploitable vulnerability but a supply-chain malware upload (CWE-506, Embedded Malicious Code): IO::Socket::SSL::SelfCertificate v1.00 on CPAN is itself a malicious dropper. The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) overstates network-exploitability - the description explicitly states the package has NO test scripts nor build hooks, meaning it does NOT auto-execute on install and instead requires the victim to install the package AND call generate_certificate(). That makes real-world triggering user-interaction-dependent (UI:R) and effectively local, so AV:N/UI:N is misleading - verify against the reality that a human must run the function. Corroborating signals point AWAY from urgency: EPSS is 0.12% (1st percentile), it is NOT in CISA KEV, and no POC/exploit code is referenced (none is needed - the code IS the payload). The genuine risk is real but narrow: anyone who installed this specific malicious release and invoked its certificate-generation routine would fetch and execute attacker-controlled Python from a hardcoded, base64-obfuscated HTTP URL as their own user. Given the package was flagged by CPANSec and is a brand-new v1.00 malicious upload, exposure is limited to the small set of users who pulled it before removal.

A developer installs IO::Socket::SSL::SelfCertificate 1.00 from CPAN (e.g., mistaking it for the legitimate IO::Socket::SSL family) and later calls generate_certificate(), which runs the bundled Python dropper (lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem). The script decodes a base64-obfuscated hardcoded HTTP URL, downloads the response body, and executes it in memory as the invoking user with no file dropped to disk. No public POC is referenced because the package itself contains the live malware.