CVE-2026-74886CWE-184

CVE-2026-74886

Critical · published August 17, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-08-17T15:16Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.01.4.0
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-9pgj-v69p-q586 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-plugin-import-guard-bypass · [email protected]
EPSS history
Timeline
  • 17 AUG 11:04Z
    openssl_encrypt before 1.4.0 Plugin Import Guard Bypass
    cvelistv5