External risk intelligence

Perl IO::Socket::SSL::SelfCertificate Executes Obfuscated Python Code

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-97230

This vulnerability exists in a software library (Perl module). It is a supply-chain risk affecting development-time or build-time environments where the package is installed, rather than a network-accessible service or application that is inherently exposed to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in a Perl software library that could allow malicious Python code to execute on a system without saving a file. This occurs when the library processes a specially crafted certificate file. While the primary concern is confirming relevance and exposure within development or build environments, the execution of arbitrary code presents a potential risk.

Malware executes code from a hidden URL.
Affects build or development environments.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by triggering a Python script embedded within a certificate file. This script is designed to fetch and execute obfuscated Python code from a hardcoded URL, allowing arbitrary code execution with the privileges of the user running the script.

Unauthenticated network access required.
Triggered by running the vulnerable script.
Arbitrary code execution as the user.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow arbitrary Python code execution as the user when the `generate_certificate` function is run. The malware retrieves obfuscated Python code from a hardcoded URL and executes it directly, meaning no script is saved to the host system. This can occur when the affected Perl module is installed and this function is invoked.

Arbitrary code execution.
Executed via obfuscated URL retrieval.
Malware runs as the user.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `IO::Socket::SSL::SelfCertificate` module in Perl is likely managed by application owners or development teams responsible for managing Perl dependencies. The initial step is to identify all systems where this module is installed, determine its business criticality, and pinpoint the accountable owner for remediation planning.

Identify module installations and ownership.
Verify module usage and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the IO::Socket::SSL::SelfCertificate Perl module?

It is a library used within the Perl programming ecosystem designed to assist in creating self-signed certificates. Developers typically integrate such modules into their code to handle SSL/TLS certificate generation tasks automatically during application development or testing phases.

What does CWE-506 mean in the context of CVE-2026-97230?

CWE-506 represents an Embedded Malicious Code weakness. In this specific case, it means the software package contains hidden, harmful functionality—a Python script—intentionally placed within the library. This script acts as a dropper that fetches and runs external code from a remote URL whenever the affected certificate generation function is triggered.

How is the malicious code triggered?

The malware executes when the generate_certificate function within the library is invoked. Simply having the library installed on a system does not automatically trigger the malicious payload; the specific function must be called and the associated certificate file processed for the code to fetch and execute.

Why is this a supply-chain risk rather than a direct web threat?

According to Halo Surface Signal, this vulnerability impacts development or build-time environments where the package is installed. Because it is a library rather than a network-accessible service, it is generally not exposed to the public internet, making it a risk to the software supply chain during the coding or deployment process.

How do I respond if I am running this technology?

Your first step is to perform an inventory of your systems to identify where the IO::Socket::SSL::SelfCertificate module is installed. Once located, work with the development or application teams responsible for that environment to verify usage, determine if the module is necessary, and plan for its removal or replacement to eliminate the risk.

References

www.cve.org/CVERecord?id=CVE-2026-95831

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.