CVE-2026-81690

openssl-encrypt before 1.4.9 contains a symlink-following flaw (CWE-59) in its verify-usb v2 added-file allowlist scan: the drive is enumerated with rglob(), which in CPython does not descend into symlinked directories, while the O_NOFOLLOW flag on the hashing side only protects the final path component, so files reached through a symlinked directory are never enumerated. An evil-maid attacker with brief physical access to the removable drive can replace a tool-tree directory with a symlink to a copy holding byte-identical files plus a planted __pycache__/*.pyc, which CPython loads in preference to recompiling the clean .py; verify-usb then reports PASSED with added_files remaining 0. When the victim runs the portable install, the planted .pyc executes, giving the attacker code execution on the victim's system despite the verification having passed. Users of the openssl-encrypt pip package (vendor jahlives) on 1.4.x before 1.4.9, and on the 1.5.x line which the advisory also lists as affected, who rely on verify-usb to validate portable USB installs are exposed. No exploitation is currently known: there is no public PoC, the flaw is not in CISA KEV, EPSS estimates a 0.5% probability of exploitation in the next 30 days, and the flaw carries a CVSS 4.0 score of 8.7 (High).

What to do: Upgrade openssl-encrypt to 1.4.9 or later; the advisory also lists the 1.5.x line as affected, so confirm the fixed release on that line before staying on it. Until patched, do not treat verify-usb 'PASSED' results as assurance for drives that have left physical custody, and manually inspect the USB tool tree for symlinked directories and unexpected __pycache__/*.pyc files, deleting the planted .pyc files to force clean recompilation.