EUVD-2026-60115
GHSA-xgx5-9hx8-gf84
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Sandbox escape crosses a security boundary to the host so S:C with full C/I/A; PR:N reflects the intended untrusted-plugin model, though supplying plugin code is a practical prerequisite.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.
AnalysisAI
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions before 1.4.0, where the DangerousPatternVisitor AST analyzer fails to catch dunder-based attribute traversal. Because the library's security model is to safely execute untrusted plugin code, an attacker who can supply a plugin can chain __class__, __bases__, __subclasses__() and __globals__ to reach restricted functions and run arbitrary OS commands, fully defeating the sandbox. Reported by VulnCheck with a vendor patch available; no public exploit or CISA KEV listing was identified at time of analysis.
Technical ContextAI
openssl_encrypt is a Python library that offers a plugin execution capability guarded by a static AST-based allowlist/denylist. The DangerousPatternVisitor walks the abstract syntax tree of plugin code looking for dangerous patterns, but it does not account for Python's introspection ('dunder') graph: from any object, __class__ reaches the type, __bases__/__subclasses__() enumerate the class hierarchy up to object, and __globals__ on a reachable function exposes module globals including builtins. This maps to CWE-693 (Protection Mechanism Failure): the sandbox is present but incomplete, so the traversal reaches os/subprocess-style callables the analyzer intended to block. The affected package is identified as cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:* - note the name is misleading, as this is an independent developer's tool, not the OpenSSL project.
RemediationAI
Vendor-released patch: upgrade to openssl_encrypt 1.4.0 or later, which is the first release outside the affected range and per the vendor advisory contains the fix; see GHSA-w7gr-9g4g-33mx (https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-w7gr-9g4g-33mx). Until you can upgrade, stop accepting untrusted or third-party plugin code and restrict plugin submission to trusted, reviewed sources only, since that removes the sole exploitation path (trade-off: disables the plugin feature for external users). If plugins must run, isolate the interpreter at the OS level - run it as an unprivileged user inside a container or seccomp/AppArmor confinement with no outbound network and a read-only filesystem - so that a sandbox escape does not translate into meaningful host access (trade-off: added operational complexity and possible plugin functionality loss). Do not rely on the in-process AST analyzer as the only control, as this CVE demonstrates it is bypassable.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today