Executive brief
openssl_encrypt is a file encryption tool that automatically detects the encryption method when decrypting files. A vulnerability in versions before 1.4.9 fails to safely handle specially crafted key identifiers, allowing attackers to inject terminal control sequences that can repaint terminal output and forge authenticity verification messages. This could mislead users into trusting malicious files.
Technical details
The vulnerability is an improper output neutralization flaw (CWE-117) in the decrypt auto-detection code path. The detect_encryption_type() function parses an untrusted encrypted file header using bare json.loads() and prints attacker-controlled key_id values to stderr without escaping. An attacker can craft an encrypted file with escape sequences or cursor-movement bytes in the key_id field to repaint terminal output and forge the fingerprint/verification block—the only out-of-band authenticity check offered by the design. The fix in version 1.4.9 implements output sanitization via sanitize_for_display(), caps the recipient list size, and pre-validates the header with a security scan (size/depth/control-character bounded) before JSON parsing. Network attack vector is possible if the tool processes remotely-sourced encrypted files.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-12: disclosed: GitHub security advisory GHSA-jwfm-99h7-2w5x published
- 2026-08-27: advisory: CVE-2026-81695 published on NVD
- 2026-08-27: patched: Version 1.4.9 released with fixes