PUBLISHED
2026-03-29 01:15
MODIFIED
2026-03-29 01:15
EPSS (Prob. Exploit)
0.48%
Top 58.5%
> DESCRIPTION
GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization.
GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. The client connects to remote hosts to execute code on them. A compromised or malicious remote host can execute arbitrary code back on the client through unsafe deserialization in the RPC protocol.
read_operation() in lib/GRID/Machine/Message.pm deserialises values from the remote side using eval()
$arg .= '$VAR1';
my $val = eval "no strict; $arg"; # line 40-41
$arg is raw bytes from the protocol pipe. A compromised remote host can embed arbitrary perl in the Dumper-formatted response:
$VAR1 = do { system("..."); };
This executes on the client silently on every RPC call, as the return values remain correct.
This functionality is by design but the trust requirement for the remote host is not documented in the distribution.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). | CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
> GITHUB SECURITY ADVISORY
GHSA-v5ff-9q35-q26f
CRITICAL
Langflow: Unauthenticated RCE in Shareable Playgrounds
AFFECTED PACKAGES:
PIP / langflow
<= 1.9.1
Fixed in: 1.9.2
> HISTORIQUE DES MODIFICATIONS
Première apparition
29/03/2026 01:15
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - The product receives input from an upstream component, but it does not neutralize or incorrectly neutra...
Nouvelle valeur:
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax b...
📊
ENRICHISSEMENT
01/04/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - The product receives input from an upstream component, but it does not neutralize or incorrectly neutra...
Total des modifications: 2
Dernière mise à jour: 1 week ago