CVE-2026-81696CWE-117

CVE-2026-81696

Low · published August 27, 2026

CVSS v3.1

3.3

EPSS

Percentile

15.5

In the wild

Unconfirmed

What it is

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

The record

Technical detail

CVSS v3.1: 3.3 · LOW
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00250 · 15.5th percentile
Weakness: CWE-117 · Improper Output Neutralization for Logs
Published: 2026-08-27T21:20Z

Affected products (1)

Product	Versions	Fixed in
jahlives/openssl_encrypt	< 1.4.9	1.4.9

References (2)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-539p-fxf4-7fv8 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injection-via-info-command · [email protected]

EPSS history

Timeline

27 AUG 14:50Z
openssl_encrypt before 1.4.9 Terminal Injection via info Command
cvelistv5