EUVD-2026-60091
GHSA-ccp9-5g7c-pj86
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation needs local write access to a site-packages directory (AV:L, PR:L for an unprivileged user), no interaction, and yields full native code execution (C:H/I:H/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.
AnalysisAI
Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from its Whirlpool hash routine loading .so extension modules via a broad glob pattern without any integrity check. An attacker who can drop a file matching 'whirlpool*py313*.so' into a site-packages directory gets their code executed in-process the moment the hashing module is imported. Reported by VulnCheck; a vendor patch (1.4.0) exists, and there is no public exploit identified at time of analysis.
Technical ContextAI
The affected component is openssl_encrypt/modules/registry/hash_registry.py (lines 570-589), a pure-Python cryptography helper distributed on PyPI as openssl-encrypt. To provide a Whirlpool hash, it enumerates site.getsitepackages() directories, runs glob.glob() against the pattern 'whirlpool*py313*.so', takes the FIRST match, and loads it through importlib's ExtensionFileLoader / exec_module - running the shared object's native init code. This maps to CWE-426 (Untrusted Search Path): the loader trusts an attacker-influenceable filesystem location and a wildcard filename rather than a pinned path, hash, or signature. Because it is an extension-module load, execution is fully native (not sandboxed Python), inheriting the privileges of the importing process. The CPE cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:* identifies the single affected product.
RemediationAI
Upgrade to the fixed release - Vendor-released patch: openssl-encrypt 1.4.0 (pip install --upgrade openssl-encrypt), which corresponds to upstream commit 963d0d1278b722ea134272f9df65fddcd3e6ab47 on branch releases/1.4.x; the fix adds os.path.realpath() symlink resolution and validates that any discovered .so resides within a known site-packages path before loading. Until you can upgrade, compensating controls include: restrict write permissions on all site-packages directories so only root/administrators can add files (side effect: breaks per-user 'pip install --user' workflows and in-place package edits); avoid invoking the Whirlpool hash code path if your usage allows selecting a different algorithm (side effect: functionality loss where Whirlpool is required); and run applications importing this package under least-privilege service accounts and file-integrity monitoring on site-packages to detect rogue whirlpool*py313*.so files. Advisory references for tracking: GHSA-j48q-4c78-rhf9 and the VulnCheck advisory above.
More in Openssl Encrypt
View allFingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today