The vulnerability in openssl_encrypt before version 1.4.0 allows a sandbox escape through the IsolatedPluginExecutor. By accessing Python type objects in restricted exec() builtins, an attacker can traverse the class hierarchy via __class__.__mro__.__subclasses__() and reach system functions, enabling execution of arbitrary OS commands. This compromises confidentiality, integrity, and availability of the affected system.

The affected product is openssl_encrypt from vendor jahlives. All releases prior to 1.4.0 are vulnerable. No other product versions are listed.

With a CVSS score of 9.3 this vulnerability is rated high. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the critical impact and potential for exploitation remain. Likely attack vectors involve any environment that loads the vulnerable library and executes IsolatedPluginExecutor without proper restrictions, allowing an attacker to invoke exec() or related functions to run system commands.