This vulnerability resides in the openssl_encrypt Python package version 1.4.8 or earlier, where the desktop GUI incorrectly transmits the steganography password to the child CLI process via the command line argument ‑‑stego‑password. The password value is therefore exposed in the process command line, allowing any local user to read it from /proc/<pid>/cmdline during the subprocess’s lifetime. The exposure leaks confidential steganography credentials, compromising the secrecy of messages secured with that password only, but representing a clear confidentiality violation.

The affected software is the openssl_encrypt package distributed through pip, authored by jahlives, and all release versions up to and including 1.4.8. The vulnerability is limited to environments where the desktop GUI launches a CLI subprocess; operating systems are not explicitly specified but the exposed information is read from the Linux /proc filesystem.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, suggesting low to moderate current exploitation probability. The vulnerability is not listed in CISA KEV and is accessible only to local users who can observe running processes on the host. An attacker would need local user access and would obtain the steganography password, leading to a confidentiality breach but not a full system compromise.