Is CVE-2026-81696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81696 being exploited in the wild.

How severe is CVE-2026-81696?

Medium severity, with a CVSS score of 4, published 27 August 2026.

Which products and versions are affected?

Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81696?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81696 attacked?

It is attacked with local access.

Am I affected by CVE-2026-81696?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81696: openssl_encrypt terminal injection in info command

CVE-2026-81696 · Severity: medium · CVSS 4 · Published 2026-08-27

openssl_encrypt is a command-line encryption utility that displays file metadata through its info command. A flaw allows attackers to craft malicious encrypted files with terminal control characters embedded in metadata fields, which are then printed without sanitization, letting attackers repaint terminal output and forge verification information that users rely on to validate file integrity.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81696 being exploited in the wild.
How severe is CVE-2026-81696?: Medium severity, with a CVSS score of 4, published 27 August 2026.
Which products and versions are affected?: Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81696?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81696 attacked?: It is attacked with local access.
Am I affected by CVE-2026-81696?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability is an improper output neutralization flaw (CWE-117) in the print_file_info function of openssl_encrypt versions before 1.4.9. The info command prints metadata fields (algorithm, encryption_data, cipher_chain, layer_info, hashes, keys, and plugin configurations) directly to the terminal without escaping terminal control characters such as ANSI escape sequences and bidirectional text overrides. Because the v14 schema allows additionalProperties in the encryption object and the JSON validator does not sanitize escape sequences during parsing, a crafted file with embedded \u001b or other control characters can survive decoding and be emitted raw to the terminal. An attacker can leverage cursor-movement, erase-line, and bidirectional override bytes to repaint output, including forging the Fingerprint/verification line that users consult. The fix in version 1.4.9 applies sanitize_for_display() to all metadata-derived values and the reconstructed CLI printer line before terminal output.

Affected products

jahlives openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81696
PYSEC-2026-3775

Timeline

2026-08-12: disclosed
2026-08-12: patched: Version 1.4.9 released with sanitize_for_display() fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.