CVE-2026-81698
HighCVSS 7.5Summary
openssl_encrypt before 1.4.9 contains a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
Risk Assessment
A user may inadvertently execute malicious commands, leading to system compromise or data loss.
Recommendation
Upgrade openssl_encrypt to 1.4.9 or later, which properly quotes metadata fields.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.