Which versions of openssl_encrypt are affected by EUVD-2026-60114?

The jahlives openssl_encrypt library contains a vulnerability that could give attackers unrestricted system access and data access on all affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-60114?

Within 24 hours, inventory all systems and applications using jahlives library and document currently deployed versions across infrastructure. Within 7 days, apply vendor patch to version 1.4.0 or later in non-production environments and verify functionality before wider deployment. Within 30 days, complete patch deployment across all production systems and decommission or isolate any remaining unpatched instances.

openssl_encrypt EUVD-2026-60114

Q: What is the CVSS score of EUVD-2026-60114?

EUVD-2026-60114 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-74895 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-08-17 VulnCheck

GHSA-562w-22q6-g455

Python Information Disclosure Openssl Encrypt Jahlives

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Exploitation needs a loaded attacker-supplied plugin, so AV:L and PR:L; the missing sandbox breaks the intended confinement boundary (S:C) yielding full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 13:03 vuln.today

Patch available

Aug 17, 2026 - 12:01 EUVD

CVE Published

Aug 17, 2026 - 11:04 cve.org

CRITICAL 9.3

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

Articles & Coverage 2

News 10 New Python Vulnerabilities - 3 Critical, 7 High, 2 With POC Aug 18, 2026 News Critical Sandbox Escape in openssl_encrypt Python Library - CVE-2026-74895 Aug 17, 2026

AnalysisAI

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run without any isolation because the default process-isolation mode silently fails to enforce its sandbox restrictions. An attacker able to supply or influence a plugin gains unrestricted filesystem, network, subprocess, and full Python-module access equivalent to arbitrary code execution. Reported by VulnCheck with a vendor patch available; no public exploit code or CISA KEV listing is identified at time of analysis (CVSS 4.0 base 9.3).

Technical ContextAI

openssl_encrypt is a Python encryption utility that supports an extensible plugin architecture; plugins are meant to run under a 'process isolation' sandbox that constrains what host resources they may touch. The root cause maps to CWE-693 (Protection Mechanism Failure): the security control exists by design but is not actually applied in the default mode, so the intended confinement boundary is absent rather than merely weak. Because the plugins execute as native Python, an unsandboxed plugin inherits the full capabilities of the host interpreter - open(), socket, subprocess/os.system, and import of any module - making the missing sandbox equivalent to arbitrary code execution. The single affected CPE is cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade openssl_encrypt to version 1.4.0 or later, which is the vendor-released patch that restores sandbox enforcement in process-isolation mode (patch available per the vendor advisory GHSA-623h-chj7-hfx8). Until you can upgrade, treat the plugin execution path as unsandboxed: only load plugins from sources you fully trust, do not run openssl_encrypt against attacker-controlled or third-party plugin files, and where possible avoid the default process-isolation mode or externally confine the whole process (dedicated low-privilege user, container/seccomp/AppArmor, no outbound network) since the application-level sandbox cannot be relied upon - the trade-off is that OS-level confinement may break plugins that legitimately need filesystem or network access. Review the vendor advisory (https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-623h-chj7-hfx8) and the VulnCheck writeup for any additional configuration guidance before re-enabling untrusted plugins.