CVE-2026-74895

openssl_encrypt plugin sandbox escape allows arbitrary code execution.

• CVSS 9.3
• 693
• Authentication, Authorization, and Session Management
• Local

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

CVE

CVE-2026-74895

CWE

693

CVSS base score

9.3

Published

2026-08-17

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Authentication, Authorization, and Session Management

Subcategory

Poorly Designed Access Controls

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade the `build` package to version 1.0.0 or later.

import os
import sys

def execute_plugin(plugin_code):
    """
    Executes a plugin using the default process isolation mode.
    This mode is intended to sandbox the plugin's execution.
    """
    # VULNERABLE: The 'sandbox' is not applied; exec() runs the plugin code
    # with full access to builtins, granting it unrestricted permissions.
    exec(plugin_code, {'__builtins__': __builtins__})

import os
import sys
from restrictedpython import compile_restricted
from restrictedpython.Guards import safe_builtins

def execute_plugin(plugin_code):
    """
    Executes a plugin using the default process isolation mode.
    This mode is intended to sandbox the plugin's execution.
    """
    # FIX: The plugin code is compiled in a restricted mode and executed
    # with a limited set of safe builtins to enforce the sandbox.
    byte_code = compile_restricted(plugin_code, '<plugin>', 'exec')
    exec(byte_code, {'__builtins__': safe_builtins})

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202674895,
  title        = {{openssl_encrypt plugin sandbox escape allows arbitrary code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-74895},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-74895/}}
}