CVE-2026-74899

jahlives openssl_encrypt versions before 1.4.0 contain a sandbox escape (CWE-95) in the IsolatedPluginExecutor component, which exposes Python type objects in the builtins available to code executed via restricted exec() calls. An attacker who can get crafted code into the sandbox (for example, by supplying a plugin) can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to reach and invoke system functions. This grants arbitrary operating-system command execution under the privileges of the host process; the flaw is rated 9.3 critical under CVSS 4.0 with a network attack vector and no privileges or user interaction required. Only deployments running openssl_encrypt older than 1.4.0 that execute untrusted code or plugins through IsolatedPluginExecutor are affected; version 1.4.0 and later are not. No exploitation in the wild is currently known (not in CISA KEV; EPSS is about 0.5%), but a public proof-of-concept reference exists in the vendor's GitHub security advisory GHSA-m25m-ggxg-239c.

What to do: Upgrade openssl_encrypt to version 1.4.0 or later. Until upgraded, avoid running untrusted or third-party code through IsolatedPluginExecutor, or restrict the builtins exposed to exec() so Python type objects are not reachable. Review the vendor advisory (GHSA-m25m-ggxg-239c) and check whether your deployment executes user-supplied plugins inside the sandbox.