PT-2026-28652 · Unknown · Grid::Machine

Piedcrow · Published 2026-03-28 · Updated 2026-03-29 · CVE-2026-4851

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GRID::Machine versions through 0.127

Description GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. A compromised or malicious remote host can execute arbitrary code on the client through unsafe deserialization in the RPC protocol. The read operation() function in lib/GRID/Machine/Message.pm deserializes values from the remote side using eval(). The variable $arg receives raw bytes from the protocol pipe, allowing a compromised remote host to embed arbitrary Perl code in the Dumper-formatted response, which is then executed on the client with every RPC call. The trust requirement for the remote host is not documented. The API endpoint is not explicitly mentioned. The vulnerable parameter is $arg.

Recommendations Versions prior to 0.128 should be considered vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Eval Injection

Weakness Enumeration

CWE-502

CWE-95

Related Identifiers

CVE-2026-4851

Affected Products

Grid::Machine

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4851 · Security Note
• https://twitter.com/cyberbivash/status/2038080434836308236 · Twitter Post
• http://openwall.com/lists/oss-security/2026/03/26/6 · Note
• https://openwall.com/lists/oss-security/2026/03/26/6 · Note
• https://twitter.com/CVEarity/status/2038258159861768546 · Twitter Post
• https://twitter.com/oss_security/status/2037710834206375981 · Twitter Post