Vulnerability Description
openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running openssl_encrypt. Fixed in 1.4.9 by defaulting the signature policy to ENFORCE for non-built-in plugins.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jahlives | Openssl Encrypt | < 1.4.9 |
Related Weaknesses (CWE)
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-587j-4r3v-cVendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-remote-code-exThird Party Advisory
FAQ
What is CVE-2026-81719?
CVE-2026-81719 is a vulnerability with a CVSS score of 7.8 (HIGH). openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compi...
How severe is CVE-2026-81719?
CVE-2026-81719 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81719?
Check the references section above for vendor advisories and patch information. Affected products include: Jahlives Openssl Encrypt.