CVE-2026-74895CWE-693

CVE-2026-74895

Critical · published August 17, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00679 · 51.8th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-08-17T15:16Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.01.4.0
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-623h-chj7-hfx8 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-plugin-sandbox-bypass-via-process-isolation · [email protected]
EPSS history
Timeline
  • 17 AUG 11:04Z
    openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
    cvelistv5