The vulnerability in the openssl_encrypt library before version 1.4.0 causes the sandbox restrictions to be bypassed when plugins are executed in default process isolation mode. An attacker can run malicious plugins with unrestricted access to the filesystem, network, subprocess execution and all Python modules, effectively gaining full control over the host system.

The affected product is openssl_encrypt from jahlives. All installations of the library earlier than version 1.4.0 are vulnerable. No additional version details are available beyond the version boundary.

The CVSS score of 9.3 indicates a high severity vulnerability. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. Attacking the sandbox bypass would require the attacker to trigger plugin execution; therefore the attack vector is inferred to be remote plugin upload or local plugin execution abuse. The lack of sandbox enforcement allows the attacker to read, modify, delete files, initiate network connections, spawn subprocesses and import any Python module, leaving the system exposed to complete compromise.