Is CVE-2026-81695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81695 being exploited in the wild.

How severe is CVE-2026-81695?

Medium severity, with a CVSS score of 4, published 27 August 2026.

Which products and versions are affected?

Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81695?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81695 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-81695?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81695: openssl_encrypt terminal injection in decrypt auto-detection

CVE-2026-81695 · Severity: medium · CVSS 4 · Published 2026-08-27

openssl_encrypt is a file encryption tool that automatically detects the encryption method when decrypting files. A vulnerability in versions before 1.4.9 fails to safely handle specially crafted key identifiers, allowing attackers to inject terminal control sequences that can repaint terminal output and forge authenticity verification messages. This could mislead users into trusting malicious files.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81695 being exploited in the wild.
How severe is CVE-2026-81695?: Medium severity, with a CVSS score of 4, published 27 August 2026.
Which products and versions are affected?: Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81695?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81695 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-81695?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability is an improper output neutralization flaw (CWE-117) in the decrypt auto-detection code path. The detect_encryption_type() function parses an untrusted encrypted file header using bare json.loads() and prints attacker-controlled key_id values to stderr without escaping. An attacker can craft an encrypted file with escape sequences or cursor-movement bytes in the key_id field to repaint terminal output and forge the fingerprint/verification block—the only out-of-band authenticity check offered by the design. The fix in version 1.4.9 implements output sanitization via sanitize_for_display(), caps the recipient list size, and pre-validates the header with a security scan (size/depth/control-character bounded) before JSON parsing. Network attack vector is possible if the tool processes remotely-sourced encrypted files.

Affected products

jahlives openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81695
PYSEC-2026-3774

Timeline

2026-08-12: disclosed: GitHub security advisory GHSA-jwfm-99h7-2w5x published
2026-08-27: advisory: CVE-2026-81695 published on NVD
2026-08-27: patched: Version 1.4.9 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.