Description
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
Published: 2026-08-27
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Terminal output spoofing via terminal control sequences
Action: Patch Now
AI Analysis

Impact

The vulnerability in openssl_encrypt allows an attacker to embed terminal control characters in file metadata that the info command displays. Running info on a malicious file can repaint the terminal and forge verification information, misleading users about the authenticity of the data. This flaw maps to CWE-117 and does not grant direct code execution, but the misinformation can facilitate social‑engineering attacks.

Affected Systems

The affected software is openssl_encrypt from the vendor jahlives; all releases prior to version 1.4.9 fail to sanitize terminal control characters in the info command.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity, and the vulnerability is not yet listed in the CISA KEV catalog. Although the EPSS score is not available, the flaw can be exploited in any environment where users run the info command on untrusted files, enabling an attacker to deliver a crafted file and cause terminal display corruption. Immediate remediation is strongly advised.

Generated by OpenCVE AI on August 27, 2026 at 17:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade openssl_encrypt to version 1.4.9 or later.
  • Avoid invoking the info command on untrusted or downloaded files.
  • If the info functionality is not required, disable or restrict its use for ordinary users.

Generated by OpenCVE AI on August 27, 2026 at 17:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Jahlives
Jahlives openssl Encrypt
Vendors & Products Jahlives
Jahlives openssl Encrypt
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
Title openssl_encrypt before 1.4.9 Terminal Injection via info Command
Weaknesses CWE-117
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Jahlives Openssl Encrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-27T17:42:11.584Z

Reserved: 2026-08-27T11:12:00.890Z

Link: CVE-2026-81696

cve-icon Vulnrichment

Updated: 2026-08-27T17:42:07.711Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-27T17:20:59.743

Modified: 2026-09-01T20:21:05.370

Link: CVE-2026-81696

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T18:45:04Z

Weaknesses
  • CWE-117

    Improper Output Neutralization for Logs