Executive brief
openssl_encrypt is a desktop encryption utility with a GUI for managing encrypted file recovery slots. Attackers can craft malicious encrypted files with specially crafted recovery-slot identifiers that trick the GUI into displaying forged warning messages, potentially deceiving users into approving dangerous file removal operations. The vulnerability exploits insufficient sanitization of untrusted data in confirmation dialogs.
Technical details
The desktop GUI renders recovery-slot metadata (slot ID and type) from the file's list-recovery JSON output without sanitization, allowing injection of Unicode control characters (bidi overrides, U+2028/U+2029 line separators). The Flutter rendering engine honors these characters, causing attacker-controlled metadata to forge additional text lines within the irreversible-removal confirmation dialog. An attacker can craft an encrypted file with malicious slot identifiers to display fake warning text, potentially deceiving users into confirming destructive operations. The vulnerability is classified as CWE-116 (Improper Encoding or Escaping of Output). Patch 1.4.9 introduced InputValidator.sanitizeForDisplay() at the JSON decode boundary to escape all control/bidi/line-separator characters while retaining the raw slot ID for command-line operations.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-12: advisory: GitHub Security Advisory GHSA-49h2-qmcq-wvvc published
- 2026-08-27: disclosed: Public disclosure; CVE-2026-81685 assigned
- 2026-08-27: patched: Version 1.4.9 released with sanitization fix