Executive brief
Google::Auth is a library used by Perl applications to authenticate with Google Cloud Platform. A flaw allows an attacker to execute arbitrary shell commands on a system running an application that reads external account credentials from a JSON file—such as from the GOOGLE_APPLICATION_CREDENTIALS environment variable. Any application that loads untrusted credential configurations will run the attacker's command with the same privileges as the application itself.
Technical details
The vulnerability exists in the Pluggable subclass of Google::Auth::ExternalAccountCredentials, which reads the credential_source.executable.command field from an external account credentials JSON file and executes it via Perl's system() function with a single argument, causing the entire string to be interpreted by /bin/sh -c. Environment variables from credential_source.executable.environment_variables are injected into %ENV before execution. No opt-in gate or validation guards this execution path, and the Pluggable subclass is automatically selected whenever credential_source.executable is present during Application Default Credentials initialization. Attackers who can control the GOOGLE_APPLICATION_CREDENTIALS file or supply a malicious credentials.json can achieve arbitrary code execution. The fix (version 0.06+) introduces the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment variable as a mandatory opt-in gate, adds execution timeout enforcement, and implements schema validation on command output.
Affected products
- Google Auth for Perl before 0.06
Timeline
- 2026-08-04: disclosed
- 2026-07-28: patched