Catalyst
Monthly
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary shell commands via unsanitized PDF render options such as page_size, orientation, or margins. The incomplete fix in 0.6.0 still permits injection. CVSS 9.8, EPSS 0.67% (moderate probability), CISA SSVC indicates automatable and total impact, but no active exploitation reported.
Session ID disclosure in Catalyst::Plugin::Statsd for Perl (versions ≤0.10.0) occurs when the StatsD communication channel lacks encryption, leaking authentication tokens over unsecured UDP to remote StatsD daemons. CVSS 7.5 (High) reflects network-accessible confidentiality impact, but EPSS score of 0.03% (9th percentile) and SSVC assessment (no observed exploitation, partial technical impact) indicate limited real-world exploitation activity. Vendor advisory from GitHub Security (GHSA-gjvr-hq83-fc38) confirms the issue with related advisories for similar Plack-Middleware-Statsd vulnerability (CVE-2026-45179).
Timing attack exposure in Catalyst::Plugin::Authentication (all versions through 0.10024) allows side-channel inference of stored passwords or password hashes through non-constant-time string comparison. The Perl built-in `eq` operator short-circuits on first character mismatch, leaking measurable timing differences that an attacker can exploit statistically across many authentication attempts to progressively recover credential material. No public exploit has been identified at time of analysis and SSVC exploitation status is confirmed as none, though the cryptographic weakness is real and patch availability is confirmed upstream.
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary shell commands via unsanitized PDF render options such as page_size, orientation, or margins. The incomplete fix in 0.6.0 still permits injection. CVSS 9.8, EPSS 0.67% (moderate probability), CISA SSVC indicates automatable and total impact, but no active exploitation reported.
Session ID disclosure in Catalyst::Plugin::Statsd for Perl (versions ≤0.10.0) occurs when the StatsD communication channel lacks encryption, leaking authentication tokens over unsecured UDP to remote StatsD daemons. CVSS 7.5 (High) reflects network-accessible confidentiality impact, but EPSS score of 0.03% (9th percentile) and SSVC assessment (no observed exploitation, partial technical impact) indicate limited real-world exploitation activity. Vendor advisory from GitHub Security (GHSA-gjvr-hq83-fc38) confirms the issue with related advisories for similar Plack-Middleware-Statsd vulnerability (CVE-2026-45179).
Timing attack exposure in Catalyst::Plugin::Authentication (all versions through 0.10024) allows side-channel inference of stored passwords or password hashes through non-constant-time string comparison. The Perl built-in `eq` operator short-circuits on first character mismatch, leaking measurable timing differences that an attacker can exploit statistically across many authentication attempts to progressively recover credential material. No public exploit has been identified at time of analysis and SSVC exploitation status is confirmed as none, though the cryptographic weakness is real and patch availability is confirmed upstream.