Google::Auth vulnerabilities

2 known vulnerabilities in Google::Auth from CJCOLLIER. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Google::Auth: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-66902Aug 4, 2026CJCOLLIER

  Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a

• 7.5 High severity

  Google::Auth: Insertion of Sensitive Information Into Sent Data

  CVE-2026-66901Aug 4, 2026CJCOLLIER

  Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked ag