EUVD-2026-60094
GHSA-m3pp-5f32-32h9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Core weakness is a fail-open validation bypass whose realistic impact is acceptance of unvalidated/malicious metadata (integrity, I:H); no direct confidentiality or availability impact is demonstrated, and the low-privilege metadata path justifies PR:N/AC:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
AnalysisAI
Schema validation bypass in the openssl_encrypt Python package (by developer 'jahlives') before version 1.4.0 lets attackers slip malformed or malicious metadata past all JSON schema checks. Because validation fails open when the optional jsonschema library is absent - and because unknown metadata format versions are silently skipped - an attacker who controls the runtime environment or the supplied metadata can process unvalidated data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites, per the advisory: (1) the attacker removes or prevents installation of the optional 'jsonschema' Python package, causing validate_against_schema() to return early (json_validator.py lines 234-238) - this requires control over the Python runtime environment, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) rates this critical, but that rating appears inflated relative to the described mechanism, which is fundamentally an integrity/validation bypass rather than a demonstrated confidentiality or availability compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can influence the deployment - for example by uninstalling the optional jsonschema package or by crafting metadata that declares an unrecognized format-version number - submits malicious metadata to an application built on openssl_encrypt < 1.4.0. The library skips schema validation entirely and accepts the malformed data as trusted, letting the attacker smuggle unexpected or malicious fields into downstream processing. … |
| Remediation | Vendor-released patch: 1.4.0 - upgrade the openssl-encrypt pip package to 1.4.0 or later, which fixes the flaw in commit 6e7f938 on branch releases/1.4.x by making validate_against_schema() raise JSONValidationError when jsonschema is unavailable (fail-closed) instead of returning silently, and by replacing the print() warning with logging.warning(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all systems using openssl_encrypt, documenting versions, deployment locations, and business criticality levels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with c
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Integrity-protection bypass in the jahlives openssl_encrypt Python library (all versions before 1.4.0) lets an attacker
Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-n
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today