An attacker can exploit the openssl-encrypt package by placing filenames containing terminal control sequences on an untrusted USB drive. When the verify-usb command outputs the list of files, those control characters are interpreted by the terminal, repainting the screen with a forged PASSED verdict. This deceives the user into believing the device has passed verification while in fact tampering has been detected.

The vulnerability affects the Jahlives openssl-encrypt Python package, versions 1.4.8 and older. Any environment that installs this package from PyPI and uses the verify-usb command to validate USB devices is potentially impacted.

The CVSS score of 9.3 classifies this flaw as critical. Because the vulnerability is only exercised when the verify-usb command is run, the likely attack vector is a compromised USB drive that a user attaches to an affected system. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no publicly known exploits. The exploit provides no direct code execution; instead, it manipulates terminal output to mask tampering, potentially enabling a misled user to accept compromised devices.