The IO::Socket::SSL::SelfCertificate Perl module version 1.00 includes malware embedded in the sample certificate file (lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem). The generate_certificate function executes a Python script disguised as a certificate file. This script fetches code from a hardcoded HTTP URL, obfuscated with base64 encoding, and runs the response directly in memory. This results in arbitrary code execution under the privileges of the user running the module, without leaving persistent scripts on the system. The module lacks test scripts or build hooks, suggesting the payload triggers post-installation. The SHA-256 hashes of the affected files are provided for verification. This issue is categorized under CWE-506 (Embedded Malicious Code) and is similar to CVE-2026-95831.

An attacker can execute arbitrary code on the affected system with the privileges of the user running the Perl module. The malicious code is fetched and executed dynamically from an external source without leaving persistent files, increasing stealth. This can lead to compromise of the host environment where the module is installed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using IO::Socket::SSL::SelfCertificate version 1.00 from untrusted sources. Verify the integrity of the module files using the provided SHA-256 hashes. Consider removing or replacing the affected module to prevent execution of the embedded malicious code.