Command Injection Vulnerability in Google::Auth for Perl

CVE-2026-66902

What is CVE-2026-66902?

A command injection vulnerability exists in Google::Auth for Perl, where an external command defined in a credentials JSON is executed via an unrestricted system call. This occurs when using the Pluggable subclass, which processes credential_source.executable.command from the JSON input without proper validation. As a result, any application relying on controlled configurations could inadvertently execute arbitrary commands with the application’s privileges. This vulnerability poses significant security risks if untrusted configurations are utilized.

References