EUVD-2026-60105
GHSA-c7vw-vfxj-3mvh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Untrusted plugin code is attacker-supplied so PR:N/AC:L, and a sandbox escape to code execution yields full C/I/A impact; scope kept Unchanged as impact lands on the host process.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.
AnalysisAI
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime PluginImportGuard and the static AST analyzer enforce two different blocklists, so an attacker who slips past the AST's DANGEROUS_MODULES check can still import high-risk modules at runtime. By using string obfuscation or encoding to hide imports of sys, shutil, multiprocessing, importlib, or pickle, a supplied plugin escapes the sandbox and runs on the host. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
openssl_encrypt is a Python encryption utility (CPE cpe:2.3:a:jahlives:openssl_encrypt) that supports a plugin mechanism intended to safely execute third-party plugin code. It layers two defenses: a static AST analyzer that rejects code referencing a DANGEROUS_MODULES set, and a runtime PluginImportGuard that intercepts imports. The vulnerability is a classic CWE-184 (Incomplete List of Disallowed Inputs) mismatch - the two mechanisms disallow different module sets, so a module blocked by one layer may be permitted by the other. Because Python allows imports to be constructed dynamically (e.g., importlib.import_module on a decoded/concatenated string), static AST inspection cannot see an obfuscated module name, letting dangerous imports such as sys, shutil, multiprocessing, importlib, and pickle reach the runtime path where they are not consistently blocked, yielding code execution.
RemediationAI
Upgrade openssl_encrypt to version 1.4.0 or later, which the vendor has released as the fix (Patch available per vendor advisory GHSA-9pgj-v69p-q586); the exact fixed baseline is 1.4.0 since all versions below it are affected. Until the upgrade is applied, reduce exposure by not loading untrusted or externally supplied plugins and by running any plugin-processing workload as an unprivileged, isolated OS user or container so that a sandbox escape lands in a low-value context - the trade-off is reduced plugin functionality and added operational overhead. If feasible, disable the plugin execution feature entirely for workflows that do not require it, and monitor for plugin code that dynamically constructs imports (importlib usage, encoded/concatenated module names) as a detection aid; consult the vendor advisory and the VulnCheck advisory (https://www.vulncheck.com/advisories/openssl-encrypt-before-plugin-import-guard-bypass) for authoritative guidance.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today