CVE-2026-74899

CriticalCVSS 9.8

Published: 17/08/2026(UTC)Translated: 17/08/2026(UTC)NVD NIST

Summary

openssl_encrypt before version 1.4.0 contains a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

Risk Assessment

The risk is that a malicious plugin can gain full system control by executing arbitrary commands, potentially leading to server takeover or data theft.

Recommendation

Upgrade openssl_encrypt to version 1.4.0 or later, which fixes this vulnerability.

Original NVD description (English source)

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.