# CVE-2026-81707: openssl_encrypt ANSI escape injection in identity email

Source: https://junglewise.ai/threats/cve-2026-81707-openssl-encrypt-ansi-escape-injection-in-identity-email  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81707 · Severity: critical · CVSS 9.8 · Published 2026-08-27

openssl_encrypt is a cryptographic tool that manages identity documents and cryptographic keys. A vulnerability in versions before 1.4.9 allows attackers to inject special control characters into the email field of identity bundles, enabling them to forge the fingerprint verification display that users rely on to confirm they have the correct key. An attacker can deliver a malicious identity bundle through normal key-exchange flows, tricking users into trusting an attacker's key instead of the legitimate one—undermining the out-of-band verification mechanism designed to prevent key substitution attacks.

Technologies: [Jahlives Openssl Encrypt](https://junglewise.ai/threats/technologies/openssl-encrypt). Vendors: [Jahlives](https://junglewise.ai/threats/vendors/jahlives).

## Quick answers

**Is CVE-2026-81707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81707 being exploited in the wild.

**How severe is CVE-2026-81707?** Critical severity, with a CVSS score of 9.8, published 27 August 2026.

**Which products and versions are affected?** Jahlives Openssl Encrypt before 1.4.9.

**Is there a fix for CVE-2026-81707?** A patch was published on 2026-08-12: Patched in version 1.4.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81707 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81707?** Check whether you run Jahlives Openssl Encrypt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation and inadequate output sanitization issue (CWE-20, CWE-150) in the Identity.import_public function and related identity display code. The email field of imported identity documents is accepted and printed to the terminal completely unsanitized, allowing JSON-encoded ANSI escape sequences (\u001b) to be injected. An attacker can craft a malicious bundle with escape sequences in the email field that move the cursor and overwrite the genuine "Fingerprint:" verification line with an attacker-chosen fingerprint. The attack is reachable via normal contact-exchange flows (file imports, GUI paste) and keyserver responses without authentication. The fix (available in version 1.4.9) validates all identity metadata at import boundaries and implements a display sanitizer that escapes control characters and special sequences at every terminal output point.

## Affected products

- jahlives openssl_encrypt before 1.4.9

## Timeline

- 2026-08-27: disclosed: CVE-2026-81707 and GHSA-qjr2-x6mr-8xgf published
- 2026-08-12: patched: Patched in version 1.4.9

## References

- [https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-qjr2-x6mr-8xgf](https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-qjr2-x6mr-8xgf)
- [https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-ansi-escape-injection-via-identity-email](https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-ansi-escape-injection-via-identity-email)

## Related threats

- [openssl_encrypt KDF cost parameter validation bypass](https://junglewise.ai/threats/cve-2026-81721-openssl-encrypt-kdf-cost-parameter-validation-bypass)
- [openssl_encrypt memory exhaustion in identity file protection block](https://junglewise.ai/threats/cve-2026-81720-openssl-encrypt-memory-exhaustion-in-identity-file-protection)
- [openssl_encrypt arbitrary code execution via plugin signature bypass](https://junglewise.ai/threats/cve-2026-81719-openssl-encrypt-arbitrary-code-execution-via-plugin-signature)
- [openssl_encrypt weak PBKDF2 parameters in keyfile encryption](https://junglewise.ai/threats/cve-2026-81718-openssl-encrypt-weak-pbkdf2-parameters-in-keyfile-encryption)
- [openssl_encrypt USB drive integrity bypass with fixed KDF salt](https://junglewise.ai/threats/cve-2026-81717-openssl-encrypt-usb-drive-integrity-bypass-with-fixed-kdf-salt)