# CVE-2026-95831: Crypt::SelfCertificate malware in Perl module

Source: https://junglewise.ai/threats/cve-2026-95831-crypt-selfcertificate-versions-from-1-01-through-1-05-for-perl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95831 · Severity: high · CVSS 7.8 · Published 2026-09-22

Crypt::SelfCertificate is a Perl module for generating X.509 certificates. Versions 1.01 through 1.05 contain malicious code that downloads and executes arbitrary Python payloads from a remote server when the generate_certificate function is called. An attacker can gain complete control of systems running vulnerable versions, potentially leading to data theft, malware installation, or system compromise.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-95831 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95831 being exploited in the wild.

**How severe is CVE-2026-95831?** High severity, with a CVSS score of 7.8, published 22 September 2026.

**Which products and versions are affected?** CPAN Crypt::SelfCertificate 1.01 through 1.05.

**Is there a fix for CVE-2026-95831?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95831 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-95831?** Check whether you run CPAN Crypt::SelfCertificate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The module contains embedded Python scripts in certificate files (validate.p12 in 1.01, cert7.pem in 1.05) that execute during certificate generation. These scripts fetch obfuscated code from http://144.172.104.211/settings/privacy.php and execute it directly without validation. Attack vector is local execution when generate_certificate() is called; no authentication or network connectivity from the victim is required beyond reaching the attacker's server.

## Affected products

- CPAN Crypt::SelfCertificate 1.01 through 1.05

## Timeline

- 2026-09-22: disclosed: CPANSec identified malware in versions 1.01 and later; module removed from CPAN

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://www.nntp.perl.org/group/perl.cpan.testers.discuss/2026/09/msg4754.html](https://www.nntp.perl.org/group/perl.cpan.testers.discuss/2026/09/msg4754.html)