Executive brief
openssl_encrypt is a Python library used for encryption operations. A critical vulnerability allows untrusted third-party plugins to execute arbitrary code with user privileges when loaded, because the signature verification policy defaulted to WARN instead of ENFORCE. If an attacker tricks a user into loading a malicious plugin, the attacker gains full control of the user's system and all data accessible to that user.
Technical details
The vulnerability is a code injection flaw (CWE-94) in openssl_encrypt's plugin loading mechanism. When a non-built-in plugin is imported at runtime, the library compiles and executes it in the host process before the runtime sandbox is installed. The signature policy defaulted to WARN, meaning unsigned or unverifiable plugins were executed anyway, with only an incomplete and bypassable AST denylist as protection. An attacker can craft a malicious plugin that, when imported by a user, executes arbitrary code with the full privileges of the running process. The vulnerability requires user interaction (inducing the user to load the plugin) but no authentication. Fixed in version 1.4.9 by changing the default signature policy to ENFORCE, requiring plugin signatures to be verified before execution.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-12: disclosed
- 2026-08-27: advisory
- 2026-08-27: patched: Version 1.4.9 released with signature policy default changed to ENFORCE