EUVD-2026-67051
GHSA-v9v6-j75g-2wmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft file with escape sequences in key_id
-
DeliveryDeliver malicious encrypted file to victim
-
ExploitVictim decrypts on vulnerable build
-
ExecutionUnescaped key_id printed to stderr
-
PersistTerminal repainted, forged verification shown
-
ImpactVictim trusts tampered file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log output neutralization
|
| Exploitation Conditions | Exploitation requires (1) the victim to run a vulnerable openssl_encrypt version before 1.4.9, (2) the victim to decrypt an attacker-crafted file whose key_id metadata carries ANSI/VT terminal escape sequences, and (3) the output to be rendered in an interactive terminal emulator that interprets those escape sequences during the decrypt key auto-detection phase. Limiting factors: the attacker cannot execute code and gains only terminal-display deception; the attack fails if stderr is redirected to a non-interpreting sink, if control characters are stripped, or if the victim never processes the malicious file - so real impact depends on social engineering and the victim trusting on-screen verification output. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3 Critical) overstates real-world impact and is internally inconsistent with the described mechanism. The actual impact is deception via terminal manipulation, not direct compromise of confidentiality, integrity, or availability of the host - so VC:H/VI:H/VA:H is questionable. Critically, the vector marks UI:N, but exploitation inherently requires a victim to decrypt an attacker-supplied file and view the output in an interpreting terminal, which is user interaction and a meaningful limiting factor. There is no EPSS score, no KEV listing, and no published POC in the provided data, indicating a low-probability, opportunistic social-engineering-style issue rather than a mass-exploitable RCE. Verdict: a legitimate integrity/trust-spoofing bug worth patching, but not a drop-everything Critical; the gap between the 9.3 label and the CWE-117 mechanism should be reconciled with the vendor. |
| Exploit ScenarioDerived | An attacker crafts an openssl_encrypt file whose key_id contains ANSI escape sequences and delivers it to a victim via email attachment, shared repo, or download. When the victim runs decryption on a pre-1.4.9 build, the auto-detection routine prints the malicious key_id to stderr, and the injected sequences repaint the terminal to overwrite genuine output and display a forged 'authenticity verified' block, convincing the victim the file is trustworthy. No public POC is identified at time of analysis, but the technique is well-understood and low-complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Terminal escape-sequence injection in jahlives' openssl_encrypt (a Python OpenSSL-based file encryption utility) before 1.4.9 lets an attacker embed ANSI/VT control sequences in the key_id field of a crafted encrypted file; because the tool prints this attacker-controlled value unescaped to stderr during decrypt key auto-detection, an attacker can repaint the terminal and forge authenticity-verification output to deceive the operator. Any user who decrypts a malicious file is affected. This is a CWE-117 output-neutralization flaw reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
RemediationAI
Vendor-released patch: 1.4.9 - upgrade openssl_encrypt to version 1.4.9 or later, per GHSA-jwfm-99h7-2w5x (https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-jwfm-99h7-2w5x). Until upgraded, do not decrypt untrusted files while viewing output directly in an interactive terminal; instead redirect stderr to a file or pipe through a sanitizer such as 'cat -v' or 'sed' to strip control characters (trade-off: makes diagnostic output harder to read), or run decryption in a non-interpreting log-capture environment that does not render ANSI escapes. Treat the tool's on-screen authenticity/verification messages as untrusted for pre-1.4.9 versions and independently verify file integrity out-of-band (e.g., compare a known-good hash) rather than relying on the terminal display.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is openssl_encrypt (CPE cpe:2.3:a:jahlives:openssl_encrypt), a command-line wrapper around OpenSSL cryptographic primitives that stores metadata such as a key_id inside its encrypted file format. During decryption the tool auto-detects which key to use and echoes the file's key_id to stderr as diagnostic output. The root cause is CWE-117 (Improper Output Neutralization for Logs/output): the key_id string is taken verbatim from the untrusted file and written to a terminal without stripping or escaping control characters. Because terminals interpret ANSI/VT100 escape sequences (cursor movement, color, line clearing, screen repaint), an attacker who controls the key_id can inject sequences that overwrite previously printed lines - including the tool's own authenticity/verification messages - making a tampered or attacker-supplied file appear to have passed integrity checks.
Know when Openssl Encrypt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Victim must decrypt an attacker file in a terminal (UI:R); impact is limited terminal-output forgery/deception (I:L) with no confidentiality or availability effect and no privileges required.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
Executive ViewAI
openssl_encrypt, a Python file encryption utility, contains a critical terminal escape-sequence injection vulnerability (CVE-2026-81695) that enables attackers to spoof authentication indicators and deceive users during file decryption, creating risk of unauthorized data access if operators are manipulated into trusting malicious files. All organizations deploying this tool require immediate action to prevent data breach.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict openssl_encrypt usage to decryption of cryptographically pre-verified files from trusted sources only; deploy the tool exclusively in air-gapped, offline environments to prevent terminal-based social engineering attacks; require manual out-of-band verification of file authenticity before decryption; disable the tool for new encryption operations until patched; implement manual inspection of key_id field contents before processing any file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Exploit-DB