CVE-2026-74896

CriticalCVSS 9.8

Published: 17/08/2026(UTC)Translated: 17/08/2026(UTC)NVD NIST

Summary

openssl_encrypt before version 1.4.0 contains a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.

Risk Assessment

The risk is that a malicious plugin can bypass AST analysis and execute arbitrary system commands, potentially leading to full system compromise.

Recommendation

Upgrade openssl_encrypt to version 1.4.0 or later to eliminate this vulnerability.

Original NVD description (English source)

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.