---
id: CVE-2026-74895
title: openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
summary: >-
  openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in
  the default process isolation mode for plugin execution. Attackers can execute
  malicious plugins with unrestricted access to the filesystem, network,
  subprocess …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-693
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-17T14:43:59.273568Z'
published: '2026-08-17'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:21:03.746Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74895'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-623h-chj7-hfx8
    label: GitHub Security Advisory (GHSA-623h-chj7-hfx8)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-plugin-sandbox-bypass-via-process-isolation
    label: >-
      VulnCheck Advisory: openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via
      Process Isolation
tags:
  - cve.org
  - osv
  - pip
epss: 0.00679
epssPercentile: 0.5215
aliases:
  - PYSEC-2026-3770
  - GHSA-623h-chj7-hfx8
ecosystem: pip
patched:
  - openssl-encrypt 1.4.0
ingestedAt: '2026-09-02T19:31:25.824Z'
---

## Overview

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-74895)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/PYSEC-2026-3770