CVE-2026-74899

CRITICAL 9.8CVE-2026-74899 · PYSEC-2026-3727 · Published 17/08/2026 · updated 28/08/2026

Package	Affected versions	Patched versions
openssl-encrypt PyPI	`< 1.4.0`	`1.4.0`
openssl encrypt jahlives	`< 1.4.0`	`1.4.0`

Description

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via class.mro.subclasses() to access system functions and execute arbitrary OS commands.

NVD description

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

References

siyuan-note/siyuan security advisory · ADVISORY
vulncheck.com/advisories/openssl-encrypt-before-sandbox-escape-via-type-hierarchy · ADVISORY
jahlives/openssl_encrypt security advisory · EVIDENCE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free