CVE-2026-74899

Published: Ago 17, 2026 Last Modified: Ago 17, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL 9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Access Control Integrity Availability Other Non-Repudiation
Potential Impacts:
Read Files Or Directories Read Application Data Bypass Protection Mechanism Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands Hide Activities
Applicable Platforms
Languages: Java, JavaScript, Python, Perl, PHP, Ruby, Interpreted
Technologies: AI/ML
Likelihood of Exploit: Medium
View CWE Details
https://github.com/jahlives/openssl_encrypt/security/adviso…
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-m25m-ggxg-…
https://www.vulncheck.com/advisories/openssl-encrypt-before…
https://www.vulncheck.com/advisories/openssl-encrypt-before-sandbox-escape-via-…