The Google::Auth Perl library, version before 0.06, has a critical vulnerability (CVE-2026-66902) that allows an attacker to execute arbitrary commands with the privileges of the application process. This vulnerability is caused by the Pluggable subclass reading credential_source.executable.command from the credentials JSON and running it as `system($command)`, a single argument call that passes the whole [truncated]
The Google::Auth library for Perl, versions before 0.09, allows server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. This vulnerability affects developers and administrators using these versions, who should be aware of the potential risks and take steps to mitigate them. The library reads URLs from the credentials JSON and requests them without vali [truncated]
