Affects: GRID::Machine
Versions: 0.127 verified, likely all released versions affected.
URL: https://cpan.org/authors/id/C/CA/CASIANO/GRID-Machine-0.127.tar.gz
Description:
GRID::Machine is a module for the Perl programming language that
implements Remote Procedure Calls (RPC) over SSH.
The module has a security flaw that allows an untrusted remote to
execute arbitrary code on the client.
The subroutine read_operation() in lib/GRID/Machine/Message.pm
deserializes values from the remote side using eval():
my $val = eval "no strict; $arg"; # line 40
...where $arg is raw bytes sent from the remote over the protocol
pipe. A compromised remote host can embed arbitrary Perl code in the
response. Exploitation can occur silently, without the local side
failing and an error being visible to a user.
Proof-of-concept exploit code exists.
CPANSec has assigned CVE-2026-4851 to this issue.
Weaknesses:
CWE-94: Improper Control of Generation of Code ('Code Injection').
CWE-502: Deserialization of Untrusted Data.
Mitigation:
None. GRID::Machine should not be used with untrusted remotes.
Solution:
None, no upstream fix to be provided.
Timeline:
2026-03-24: Vulnerability reported to module author and CPANSec.
2026-03-25: First contact with author.
2026-03-25: CVE-2026-4851 assigned by CPANSec.
2026-03-26: Author indicates no fix will be provided.
2026-03-26: CPANSec advises for disclosure.
