=== CVE-2026-66902 reproduction: Google::Auth Pluggable command injection === Sun Aug 9 14:09:43 UTC 2026 fatal: refusing to fetch into branch 'refs/heads/main' checked out at '/data/pruva/project-cache/.run-views/e0d7614274d099ca25147d868040f8a99d1f2796b570b6bba6a5f6ab22c5eed5/repo' [setup] vulnerable checkout: 913fb1780202c1ee9dd640c28c01549903f8e23a (c95c77e70bec94f17e239d88050f843ea1cade95^) [setup] fixed checkout: c95c77e70bec94f17e239d88050f843ea1cade95 Preparing worktree (detached HEAD 913fb17) warning: unable to access '/home/pruva/.config/git/ignore': Permission denied warning: unable to access '/home/pruva/.config/git/attributes': Permission denied Preparing worktree (detached HEAD c95c77e) warning: unable to access '/home/pruva/.config/git/ignore': Permission denied warning: unable to access '/home/pruva/.config/git/attributes': Permission denied [setup] verified: vuln lacks the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES gate, fixed has it [setup] Perl dependencies available Warning: prerequisite JSON::MaybeXS 0 not found. Warning: prerequisite Test::LWP::UserAgent 0 not found. Warning: prerequisite Test::Perl::Critic 0 not found. Invalid LICENSE value 'Apache 2.0' ignored Invalid LICENSE value 'Apache 2.0' ignored XS.xs: In function ‘XS_Google__Auth_load_rsa_pubkey’: XS.xs:174:9: warning: ‘RSA_new’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 174 | if (!pkey) XSRETURN_UNDEF; | ^~~ In file included from /usr/include/openssl/x509.h:36, from XS.xs:7: /usr/include/openssl/rsa.h:206:28: note: declared here 206 | OSSL_DEPRECATEDIN_3_0 RSA *RSA_new(void); | ^~~~~~~ XS.xs:182:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 182 | if (n_bn) BN_free(n_bn); | ^~~~~~~~ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs:186:9: warning: ‘RSA_set0_key’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 186 | } | ^ /usr/include/openssl/rsa.h:212:27: note: declared here 212 | OSSL_DEPRECATEDIN_3_0 int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d); | ^~~~~~~~~~~~ XS.xs:189:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 189 | BN_free(n_bn); | ^~~~~~~~ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs:195:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 195 | pkey = EVP_PKEY_new(); | ^~~~~~~~ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs:199:9: warning: ‘EVP_PKEY_assign’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 199 | } | ^ In file included from XS.xs:6: /usr/include/openssl/evp.h:1330:5: note: declared here 1330 | int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key); | ^~~~~~~~~~~~~~~ XS.xs:200:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 200 | | ^ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs: In function ‘XS_Google__Auth_load_ec_pubkey’: XS.xs:274:9: warning: ‘EC_KEY_new’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 274 | if (!pkey) XSRETURN_UNDEF; | ^~~~~ In file included from /usr/include/openssl/x509.h:33: /usr/include/openssl/ec.h:968:31: note: declared here 968 | OSSL_DEPRECATEDIN_3_0 EC_KEY *EC_KEY_new(void); | ^~~~~~~~~~ XS.xs:279:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 279 | group = EC_GROUP_new_by_curve_name(nid); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:283:9: warning: ‘EC_KEY_set_group’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 283 | } | ^ /usr/include/openssl/ec.h:1042:27: note: declared here 1042 | OSSL_DEPRECATEDIN_3_0 int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group); | ^~~~~~~~~~~~~~~~ XS.xs:285:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 285 | if (EC_KEY_set_group(eckey, group) <= 0) { | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:292:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 292 | if (!point) { | ^~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:303:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 303 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:307:9: warning: ‘EC_POINT_set_affine_coordinates_GFp’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 307 | } | ^ /usr/include/openssl/ec.h:646:27: note: declared here 646 | OSSL_DEPRECATEDIN_3_0 int EC_POINT_set_affine_coordinates_GFp | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ XS.xs:312:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 312 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:316:9: warning: ‘EC_KEY_set_public_key’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 316 | } | ^ /usr/include/openssl/ec.h:1070:27: note: declared here 1070 | OSSL_DEPRECATEDIN_3_0 int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub); | ^~~~~~~~~~~~~~~~~~~~~ XS.xs:321:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 321 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:331:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 331 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:335:9: warning: ‘EVP_PKEY_assign’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 335 | } | ^ /usr/include/openssl/evp.h:1330:5: note: declared here 1330 | int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key); | ^~~~~~~~~~~~~~~ XS.xs:340:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 340 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ Warning: prerequisite JSON::MaybeXS 0 not found. Warning: prerequisite Test::LWP::UserAgent 0 not found. Warning: prerequisite Test::Perl::Critic 0 not found. Invalid LICENSE value 'Apache 2.0' ignored Invalid LICENSE value 'Apache 2.0' ignored XS.xs: In function ‘XS_Google__Auth_load_rsa_pubkey’: XS.xs:174:9: warning: ‘RSA_new’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 174 | if (!pkey) XSRETURN_UNDEF; | ^~~ In file included from /usr/include/openssl/x509.h:36, from XS.xs:7: /usr/include/openssl/rsa.h:206:28: note: declared here 206 | OSSL_DEPRECATEDIN_3_0 RSA *RSA_new(void); | ^~~~~~~ XS.xs:182:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 182 | if (n_bn) BN_free(n_bn); | ^~~~~~~~ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs:186:9: warning: ‘RSA_set0_key’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 186 | } | ^ /usr/include/openssl/rsa.h:212:27: note: declared here 212 | OSSL_DEPRECATEDIN_3_0 int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d); | ^~~~~~~~~~~~ XS.xs:189:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 189 | BN_free(n_bn); | ^~~~~~~~ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs:195:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 195 | pkey = EVP_PKEY_new(); | ^~~~~~~~ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs:199:9: warning: ‘EVP_PKEY_assign’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 199 | } | ^ In file included from XS.xs:6: /usr/include/openssl/evp.h:1330:5: note: declared here 1330 | int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key); | ^~~~~~~~~~~~~~~ XS.xs:200:13: warning: ‘RSA_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 200 | | ^ /usr/include/openssl/rsa.h:298:28: note: declared here 298 | OSSL_DEPRECATEDIN_3_0 void RSA_free(RSA *r); | ^~~~~~~~ XS.xs: In function ‘XS_Google__Auth_load_ec_pubkey’: XS.xs:274:9: warning: ‘EC_KEY_new’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 274 | if (!pkey) XSRETURN_UNDEF; | ^~~~~ In file included from /usr/include/openssl/x509.h:33: /usr/include/openssl/ec.h:968:31: note: declared here 968 | OSSL_DEPRECATEDIN_3_0 EC_KEY *EC_KEY_new(void); | ^~~~~~~~~~ XS.xs:279:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 279 | group = EC_GROUP_new_by_curve_name(nid); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:283:9: warning: ‘EC_KEY_set_group’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 283 | } | ^ /usr/include/openssl/ec.h:1042:27: note: declared here 1042 | OSSL_DEPRECATEDIN_3_0 int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group); | ^~~~~~~~~~~~~~~~ XS.xs:285:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 285 | if (EC_KEY_set_group(eckey, group) <= 0) { | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:292:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 292 | if (!point) { | ^~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:303:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 303 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:307:9: warning: ‘EC_POINT_set_affine_coordinates_GFp’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 307 | } | ^ /usr/include/openssl/ec.h:646:27: note: declared here 646 | OSSL_DEPRECATEDIN_3_0 int EC_POINT_set_affine_coordinates_GFp | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ XS.xs:312:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 312 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:316:9: warning: ‘EC_KEY_set_public_key’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 316 | } | ^ /usr/include/openssl/ec.h:1070:27: note: declared here 1070 | OSSL_DEPRECATEDIN_3_0 int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub); | ^~~~~~~~~~~~~~~~~~~~~ XS.xs:321:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 321 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:331:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 331 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ XS.xs:335:9: warning: ‘EVP_PKEY_assign’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 335 | } | ^ /usr/include/openssl/evp.h:1330:5: note: declared here 1330 | int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key); | ^~~~~~~~~~~~~~~ XS.xs:340:13: warning: ‘EC_KEY_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 340 | EC_POINT_free(point); | ^~~~~~~~~~~ /usr/include/openssl/ec.h:1003:28: note: declared here 1003 | OSSL_DEPRECATEDIN_3_0 void EC_KEY_free(EC_KEY *key); | ^~~~~~~~~~~ [setup] entrypoint mode: google_auth_default === Phase 1: vulnerable version (<0.06, commit 913fb1780202c1ee9dd640c28c01549903f8e23a) === [run] vuln attempt 1 (allow_gate=0): invoking perl trigger via ADC flow RESULT: credentials class = Google::Auth::ExternalAccountCredentials::Pluggable RESULT: fetch_access_token error: Token exchange failed with status 500: Can't connect to 127.0.0.1:9 (Connection refused) Connection refused at /data/pruva/runs/99f8b529-e441-4b2d-9b20-80b08d9955ec/bundle/repro/deps/lib/perl5/LWP/Protocol/http.pm line 49. [run] vuln attempt 1: MARKER CREATED -> pwned-via-CVE-2026-66902 vuln attempt 1 shell+env injection [run] vuln attempt 2 (allow_gate=0): invoking perl trigger via ADC flow RESULT: credentials class = Google::Auth::ExternalAccountCredentials::Pluggable RESULT: fetch_access_token error: Token exchange failed with status 500: Can't connect to 127.0.0.1:9 (Connection refused) Connection refused at /data/pruva/runs/99f8b529-e441-4b2d-9b20-80b08d9955ec/bundle/repro/deps/lib/perl5/LWP/Protocol/http.pm line 49. [run] vuln attempt 2: MARKER CREATED -> pwned-via-CVE-2026-66902 vuln attempt 2 shell+env injection [matrix] vulnerable attempts with marker: 2/2 === Phase 2: fixed version (0.06, commit c95c77e70bec94f17e239d88050f843ea1cade95), default gated === [run] fixed attempt 1 (allow_gate=0): invoking perl trigger via ADC flow RESULT: credentials class = Google::Auth::ExternalAccountCredentials::Pluggable RESULT: fetch_access_token error: Pluggable credentials are not enabled. Set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 to enable. [run] fixed attempt 1: marker absent [run] fixed attempt 2 (allow_gate=0): invoking perl trigger via ADC flow RESULT: credentials class = Google::Auth::ExternalAccountCredentials::Pluggable RESULT: fetch_access_token error: Pluggable credentials are not enabled. Set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 to enable. [run] fixed attempt 2: marker absent [matrix] fixed attempts blocked (no marker): 2/2 === Phase 3: fixed version with GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 (positive control) === [run] fixed attempt allow1 (allow_gate=1): invoking perl trigger via ADC flow RESULT: credentials class = Google::Auth::ExternalAccountCredentials::Pluggable RESULT: fetch_access_token error: Pluggable command output missing required schema fields (version, success, expiration_time) [run] fixed attempt allow1: MARKER CREATED -> pwned-via-CVE-2026-66902 fixed attempt allow1 shell+env injection [matrix] fixed+opt-in attempts with marker: 1/1 === RESULT: CONFIRMED - command injection via Pluggable external_account credentials ===