In short
- CVE-2026-74896 is a CRITICAL (CVSS 9.8) vulnerability affecting openssl-encrypt, openssl encrypt (jahlives).
- Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.6% of all vulnerabilities.
- Fix: update to 1.4.0 or later.
Description
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use class, bases, subclasses(), and globals chains to access restricted functions and execute arbitrary system commands from plugin code.
NVD description
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.
More vulnerabilities in openssl-encrypt
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free