I am working with a colleague to set up their local environment on a MAC in XAMPP, on windows my vhost looks like the one below.
When I access a URL like http://domain.l
I think you need a section for your cgi-bin.
The fact that your server can show you the script sources means the server has at least read permissions on /file/system/path/to/cgi-bin and IIRC that clashes with ScriptAlias b/c ScriptAlias expects /file/system/path/to/cgi-bin to be unaccessible for security reasons. I think your solution should look something along the lines of:
Options ExecCGI
SetHandler cgi-script