Description
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 | 1.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.9 | 1.4.9 | PYSEC-2026-3776 |
References
- GitHub Security Advisory (GHSA-gw2m-mj6q-59hc) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 Shell Injection via info command third-party-advisory