CVE-2026-74886

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-9pgj-v69p-q586	Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-plugin-import-guard-bypass	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de openssl_encrypt anteriores a la 1.4.0 contienen una vulnerabilidad de omisión de sandbox de plugin donde el PluginImportGuard bloquea un conjunto diferente de módulos que el conjunto DANGEROUS_MODULES del analizador AST. Los atacantes pueden omitir el análisis AST mediante ofuscación o codificación de cadenas para importar módulos peligrosos no bloqueados como sys, shutil, multiprocessing, importlib y pickle para la ejecución de código arbitrario.

Information

Published : 2026-08-17 11:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-74886

Mitre link : CVE-2026-74886

CVE.ORG link : CVE-2026-74886

JSON object : View

Products Affected

jahlives

openssl_encrypt

CWE

CWE-184

Incomplete List of Disallowed Inputs

{"id": "CVE-2026-74886", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74886", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-17T15:23:52.639538Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "jahlives", "product": "openssl_encrypt", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.4.0", "versionType": "semver"}], "packageURL": "pkg:pypi/openssl_encrypt", "defaultStatus": "unaffected"}]}], "published": "2026-08-17T11:16:43.390", "references": [{"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-9pgj-v69p-q586", "tags": ["Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-plugin-import-guard-bypass", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-184"}]}], "descriptions": [{"lang": "en", "value": "openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution."}, {"lang": "es", "value": "Las versiones de openssl_encrypt anteriores a la 1.4.0 contienen una vulnerabilidad de omisi\u00f3n de sandbox de plugin donde el PluginImportGuard bloquea un conjunto diferente de m\u00f3dulos que el conjunto DANGEROUS_MODULES del analizador AST. Los atacantes pueden omitir el an\u00e1lisis AST mediante ofuscaci\u00f3n o codificaci\u00f3n de cadenas para importar m\u00f3dulos peligrosos no bloqueados como sys, shutil, multiprocessing, importlib y pickle para la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "A36F4452-E3EE-4AB3-946E-C4B923C22C70", "versionEndExcluding": "1.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}