This vulnerability is a symlink following flaw in the openssl_encrypt Python package’s verify-usb component. The package’s file enumeration routine ignores symlinked directories, allowing an attacker with physical access to a removable drive to replace a legitimate directory with a symlink to a malicious copy that contains a pre‑compiled __pycache__/*.pyc file. CPython prioritizes compiled bytecode, so the malicious script is inadvertently imported while the scanner reports the check as passed. The result is arbitrary code execution when the user runs the portable installer. The weakness maps directly to CWE‑59, a path traversal / symlink vulnerability.

The affected product is the openssl_encrypt package distributed via PyPI and maintained by jahlives. Versions prior to 1.4.9 – including the 1.4.x and 1.5.x lines – are impacted.

The CVSS score of 8.7 classifies this as a high‑severity flaw. EPSS data is not available, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires physical access to the removable media and the subsequent execution of the portable installer. Once executed, an attacker can run arbitrary code with the privileges of the user running the installer. Although not exploitable over the network, the impact is significant for environments that routinely process user‑supplied USB media.