References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

http://www.openwall.com/lists/oss-security/2026/03/26/6

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization.

GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. The client connects to remote hosts to execute code on them. A compromised or malicious remote host can execute arbitrary code back on the client through unsafe deserialization in the RPC protocol.

read_operation() in lib/GRID/Machine/Message.pm deserialises values from the remote side using eval()

  $arg .= '$VAR1';
  my $val = eval "no strict; $arg"; # line 40-41

$arg is raw bytes from the protocol pipe. A compromised remote host can embed arbitrary perl in the Dumper-formatted response:

  $VAR1 = do { system("..."); };

This executes on the client silently on every RPC call, as the return values remain correct.

This functionality is by design but the trust requirement for the remote host is not documented in the distribution.

CWE-95

CWE-502

https://www.openwall.com/lists/oss-security/2026/03/26/6