PT-2026-28652 · Unknown · Grid::Machine

Piedcrow · Publicado 2026-03-28 · Atualizado 2026-03-29 · CVE-2026-4851

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GRID::Machine versions through 0.127

Description GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. A compromised or malicious remote host can execute arbitrary code on the client through unsafe deserialization in the RPC protocol. The read operation() function in lib/GRID/Machine/Message.pm deserializes values from the remote side using eval(). The variable $arg receives raw bytes from the protocol pipe, allowing a compromised remote host to embed arbitrary Perl code in the Dumper-formatted response, which is then executed on the client with every RPC call. The trust requirement for the remote host is not documented. The API endpoint is not explicitly mentioned. The vulnerable parameter is $arg.

Recommendations Versions prior to 0.128 should be considered vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Eval Injection

Enumeração de Fraquezas

CWE-502

CWE-95

Identificadores relacionados

CVE-2026-4851

Produtos afetados

Grid::Machine

Referências · 6

• https://twitter.com/cyberbivash/status/2038080434836308236 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2026/03/26/6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4851 · Nota de Segurança
• https://openwall.com/lists/oss-security/2026/03/26/6 · Nota
• https://twitter.com/CVEarity/status/2038258159861768546 · Publicação no Twitter
• https://twitter.com/oss_security/status/2037710834206375981 · Publicação no Twitter