EUVD-2026-60094
GHSA-m3pp-5f32-32h9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Core weakness is a fail-open validation bypass whose realistic impact is acceptance of unvalidated/malicious metadata (integrity, I:H); no direct confidentiality or availability impact is demonstrated, and the low-privilege metadata path justifies PR:N/AC:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
AnalysisAI
Schema validation bypass in the openssl_encrypt Python package (by developer 'jahlives') before version 1.4.0 lets attackers slip malformed or malicious metadata past all JSON schema checks. Because validation fails open when the optional jsonschema library is absent - and because unknown metadata format versions are silently skipped - an attacker who controls the runtime environment or the supplied metadata can process unvalidated data. Reported by VulnCheck and carrying a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
openssl_encrypt is a Python encryption utility distributed via PyPI (pip/openssl-encrypt). The defect lives in openssl_encrypt/modules/json_validator.py: at lines 234-238 the validate_against_schema() routine returns early with only a printed warning when the JSONSCHEMA_AVAILABLE flag is false, meaning the optional jsonschema dependency being uninstalled disables all validation. Separately (lines 288-293) metadata bearing an unrecognized format-version number bypasses validation entirely, and every schema declares additionalProperties: true, permitting arbitrary extra fields even when validation does run. This maps to CWE-345 (Insufficient Verification of Data Authenticity): the code trusts attacker-influenceable metadata without enforcing its integrity, a classic fail-open design where a missing safeguard degrades silently instead of refusing to proceed.
RemediationAI
Vendor-released patch: 1.4.0 - upgrade the openssl-encrypt pip package to 1.4.0 or later, which fixes the flaw in commit 6e7f938 on branch releases/1.4.x by making validate_against_schema() raise JSONValidationError when jsonschema is unavailable (fail-closed) instead of returning silently, and by replacing the print() warning with logging.warning(). If you cannot upgrade immediately, ensure the jsonschema library is installed and pinned as a hard requirement in your environment so validation cannot be silently disabled, and reject metadata carrying unknown format-version numbers rather than accepting it; treat any metadata from untrusted sources as unvalidated until on 1.4.0. Trade-off: enforcing jsonschema as mandatory will cause deployments that previously ran without it to fail closed, which is the intended safer behavior but may break environments that relied on the optional path. Advisories: https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-425g-fjhq-5h92 and https://www.vulncheck.com/advisories/openssl-encrypt-before-schema-validation-bypass.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today