Which versions of openssl_encrypt are affected by EUVD-2026-60116?

The jahlives Python library (versions before 1.4.0) allows attackers to bypass intended security restrictions and execute arbitrary code, effectively granting full system access to malicious actors.. A patch is available.

How to fix or mitigate EUVD-2026-60116?

Within 24 hours: Inventory all systems and applications using jahlives versions prior to 1.4.0, prioritizing production environments and business-critical systems. Within 7 days: Deploy jahlives version 1.4.0 or later across all identified systems through your change management process, conducting thorough testing in staging environments before production rollout. Within 30 days: Verify patch deployment across all systems via vulnerability scanning or software inventory tools, and audit access controls for plugin configuration to limit plugin code sources to authorized developers only.

openssl_encrypt EUVD-2026-60116

Q: What is the CVSS score of EUVD-2026-60116?

EUVD-2026-60116 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-74899 CRITICAL

Eval Injection (CWE-95)

2026-08-17 VulnCheck

GHSA-5cp4-g2w4-gm8p

Python Information Disclosure Code Injection Openssl Encrypt Jahlives

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Sandbox escape yields OS command execution on the host running the in-process executor (S:U, C/I/A:H); AV:N/AC:L/PR:N assume the executor is exposed to untrusted plugin input, which the consuming app controls.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 13:03 vuln.today

Patch available

Aug 17, 2026 - 12:01 EUVD

CVE Published

Aug 17, 2026 - 11:04 cve.org

CRITICAL 9.3

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

Articles & Coverage 2

News 10 New Python Vulnerabilities - 3 Critical, 7 High, 2 With POC Aug 18, 2026 News Critical Sandbox Escape in openssl_encrypt Python Library - CVE-2026-74899 Aug 17, 2026

AnalysisAI

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

openssl_encrypt is a Python encryption utility library (note: unrelated to the OpenSSL project despite the name) that includes an IsolatedPluginExecutor intended to run untrusted plugin code inside a restricted exec() with a pared-down __builtins__. The root cause is CWE-95 (improper neutralization of directives in dynamically evaluated code / 'eval injection'): the restricted builtins still expose concrete Python type objects, and any such object grants access to __class__.__mro__.__subclasses__(), which enumerates every loaded class in the interpreter. From that list an attacker reaches classes that import os/subprocess or otherwise wrap system calls, defeating the sandbox. The affected component is identified by CPE cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:* for all versions prior to 1.4.0.

RemediationAI

Upgrade openssl_encrypt to version 1.4.0 or later, which the vendor advisory (GHSA-m25m-ggxg-239c) identifies as the fixed release - Vendor-released patch: 1.4.0. Until you can upgrade, do not pass untrusted or attacker-influenced code to the IsolatedPluginExecutor: restrict plugin loading to vetted, first-party plugins only, and if the executor is exposed via any service, place it behind authentication and network restrictions so arbitrary users cannot submit plugin code. As a stronger compensating control, run any process that must execute third-party plugins inside a real OS-level sandbox (separate low-privilege user, container with dropped capabilities, seccomp, or gVisor), since Python's exec()-based restricted-builtins approach is not a reliable security boundary; the trade-off is added deployment complexity and possible loss of plugin functionality that relies on broad runtime access. Consult the vendor advisory and the VulnCheck advisory (https://www.vulncheck.com/advisories/openssl-encrypt-before-sandbox-escape-via-type-hierarchy) for details before making configuration changes.