Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-74883

openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jahlives openssl_encrypt

Default version status: unaffected

  • 0 to < 1.4.0affected
  • 1.4.0unaffected
pkg:pypi/openssl_encrypt

References