Loading...
Skip to main content
GeekWala

CVE-2026-74886 — Vulnerability in openssl-encrypt — CVE Details

CRITICAL

Published August 17, 2026Updated September 2, 2026Source: osv

Summary

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

Advisory Timeline

  • First published August 17, 2026 (56 days ago).
  • Last revised September 2, 2026 — 16 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

pip
Update openssl-encrypt to 1.4.0 or later
pip install "openssl-encrypt>=1.4.0"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: pypi (1).

PackageEcosystemAffectedFixed In
openssl-encrypt
pypi
0.2.2, 0.2.3, 0.2.4, 0.2.5 (+40 more)1.4.0

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Frequently Asked Questions

What is CVE-2026-74886?
This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-74886?
CVE-2026-74886 affects openssl-encrypt. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-74886 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

PYSEC-2026-3763
GHSA-9pgj-v69p-q586

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies