The vulnerability exists in the openssl_encrypt plugin prior to version 1.4.0, where the PluginImportGuard blocks a subset of modules different from the AST analyzer's DANGEROUS_MODULES list. Attackers can use string obfuscation or encoding to bypass the guard, allowing the import of modules such as sys, shutil, multiprocessing, importlib, and pickle. This enables arbitrary code execution within the context in which the plugin runs. The weakness is a mismatch in imported module filtering, aligning with CWE‑184.

The affected product is jahlives:openssl_encrypt. Versions earlier than 1.4.0 are impacted; all releases prior to 1.4.0 must be considered vulnerable.

The CVSS score of 9.3 indicates a critical level of severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation cannot be precisely quantified, but the high severity implies that once discovered, exploitation would be highly valuable to adversaries. The attack vector is not explicitly detailed, but since the flaw allows import of arbitrary Python modules to achieve code execution, it is plausible to exploit in any environment that loads the openssl_encrypt plugin with untrusted input. Attackers would need to craft a payload that obfuscates or encodes the module name to bypass the import guard, then execute code through the imported module.