PYSEC-2026-3776
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/openssl-encrypt/PYSEC-2026-3776.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3776
- Aliases
-
- CVE-2026-81698
- GHSA-gw2m-mj6q-59hc
- Published
- 2026-08-27T17:21:00.070Z
- Modified
- 2026-09-02T09:00:03.079726954Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the printed CLI block into a shell.
- References
Affected packages
PyPI / openssl-encrypt
Package
- Name
- openssl-encrypt
- View open source insights on deps.dev
- Purl
- pkg:pypi/openssl-encrypt
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.4.9
Affected versions
0.*
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.3
0.6.0rc1
0.7.0rc2
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.9.2
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0b3
1.4.0b4
1.4.0b5
1.4.0b6
1.4.0b7
1.4.0b8
1.4.0
1.4.1rc2
1.4.1
1.4.2
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8