Description
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.
Published: 2026-08-17
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in openssl_encrypt before version 1.4.0 allows a sandbox escape through the IsolatedPluginExecutor. By accessing Python type objects in restricted exec() builtins, an attacker can traverse the class hierarchy via __class__.__mro__.__subclasses__() and reach system functions, enabling execution of arbitrary OS commands. This compromises confidentiality, integrity, and availability of the affected system.

Affected Systems

The affected product is openssl_encrypt from vendor jahlives. All releases prior to 1.4.0 are vulnerable. No other product versions are listed.

Risk and Exploitability

With a CVSS score of 9.3 this vulnerability is rated high. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the critical impact and potential for exploitation remain. Likely attack vectors involve any environment that loads the vulnerable library and executes IsolatedPluginExecutor without proper restrictions, allowing an attacker to invoke exec() or related functions to run system commands.

Generated by OpenCVE AI on August 17, 2026 at 12:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update openssl_encrypt to version 1.4.0 or later.
  • Ensure that IsolatedPluginExecutor runs with a restricted exec() environment and does not expose Python type objects to users.
  • Monitor application logs for unexpected usage of __class__.__mro__.__subclasses__ or exec calls and audit for potential injection points.

Generated by OpenCVE AI on August 17, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Jahlives
Jahlives openssl Encrypt
Vendors & Products Jahlives
Jahlives openssl Encrypt

Tue, 18 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Description openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.
Title openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy
Weaknesses CWE-95
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Jahlives Openssl Encrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-18T14:40:57.653Z

Reserved: 2026-08-17T10:48:45.738Z

Link: CVE-2026-74899

cve-icon Vulnrichment

Updated: 2026-08-18T14:40:40.849Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-17T11:16:44.917

Modified: 2026-08-28T18:34:48.753

Link: CVE-2026-74899

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:40:28Z

Weaknesses
  • CWE-95

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')