https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:37:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-348771 EUVD-2026-348771 https://cve.radiocsirt.org/vuln/euvd-2026-348771 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66902 <p>Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.</p> <p>The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable&#39;s environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a &#34;type&#34;: &#34;external_account&#34; configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.</p> <p>Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.</p> <p>Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.</p> <p>The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable&#39;s environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a &#34;type&#34;: &#34;external_account&#34; configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.</p> <p>Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-66902 https://cve.radiocsirt.org/vuln/ghsa-vjmh-7f4c-cx88 <p>Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.</p> <p>The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable&#39;s environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a &#34;type&#34;: &#34;external_account&#34; configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.</p> <p>Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.</p> <p>Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call.</p> <p>The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable&#39;s environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a &#34;type&#34;: &#34;external_account&#34; configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call.</p> <p>Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.</p> https://cve.radiocsirt.org/vuln/ghsa-vjmh-7f4c-cx88