{"id":"CVE-2026-74895","title":"openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation","summary":"openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-693"],"vendor":"jahlives","product":"openssl_encrypt","affected":["openssl_encrypt < 1.4.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-17T14:43:59.273568Z"},"published":"2026-08-17","updated":"2026-10-01","sourceUpdated":"2026-10-01T15:21:03.746Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74895","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-623h-chj7-hfx8","label":"GitHub Security Advisory (GHSA-623h-chj7-hfx8)"},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-plugin-sandbox-bypass-via-process-isolation","label":"VulnCheck Advisory: openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation"}],"tags":["cve.org","osv","pip"],"epss":0.00679,"epssPercentile":0.5215,"aliases":["PYSEC-2026-3770","GHSA-623h-chj7-hfx8"],"ecosystem":"pip","patched":["openssl-encrypt 1.4.0"],"ingestedAt":"2026-09-02T19:31:25.824Z","slug":"CVE-2026-74895","body":"## Overview\n\nopenssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.\n\n## Affected\n\n- `openssl_encrypt < 1.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-74895)\n\nAffected packages:\n\n- `openssl-encrypt < 1.4.0`\n\nPatched in:\n\n- `openssl-encrypt 1.4.0`\n\nSource: https://osv.dev/vulnerability/PYSEC-2026-3770","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214433,"id":"CVE-2026-74895","ts":1790869823443,"field":"cvss","old":null,"new":"9.8"},{"seq":214432,"id":"CVE-2026-74895","ts":1790869823443,"field":"severity","old":"none","new":"critical"}]}