OpenSSL_Encrypt versions prior to 1.4.9 contain a shell injection flaw in the info command’s reconstructed CLI block. The command interpolates untrusted metadata fields, such as pepper_name, without quoting them. If an attacker supplies metadata that contains shell commands, those commands are incorporated verbatim into the printed CLI block. When an end user copies and executes this block in a shell, the malicious commands run with the user’s privileges, leading to arbitrary command execution.

The vulnerability affects the jahlives:openssl_encrypt package. All releases before 1.4.9 are susceptible. Users running any older version of this software must determine the exact release and apply a fix or upgrade to 1.4.9 or later.

The CVSS score of 9.3 indicates a critical severity. EPSS is not available, so the current exploitation probability is unknown, but the flaw has not yet been listed in the CISA KEV catalog. The attack vector is inferred to require an attacker to craft metadata containing shell commands and convince a user to copy the formatted CLI block into a shell. Because execution only occurs when a user pastes the block, the vulnerability is less directly exploitable than a traditional remote code execution, yet it still represents a high‑risk scenario if users routinely copy output from the info command.