Google::Auth versions prior to 0.06 for Perl contain an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements in an OS command. The Pluggable subclass reads the command from credential_source.executable.command in an external_account credentials JSON and executes it using a system call without any gating or validation. The environment variables from the JSON are set before execution. This allows an attacker who can supply or modify the credentials JSON to execute arbitrary commands with the application's privileges. The vulnerability is triggered when the credential_source.executable field is present, which causes make_creds to select the vulnerable subclass. Configurations lacking this field do not trigger the vulnerability.

An attacker who can supply or manipulate the external_account credentials JSON file can execute arbitrary OS commands with the privileges of the application process. This can lead to full compromise of the host running the vulnerable Google::Auth Perl module. The vulnerability has a CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted or user-controlled external_account credentials JSON files that include the credential_source.executable field. Restrict access to credential files and validate or sanitize any external_account configurations before use.