CVE-2026-81696: openssl_encrypt before 1.4.9 Terminal Injection via info Command

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-09-01
Weakness: CWE-117

Description

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

Affected products

jahlives openssl_encrypt: before 1.4.9 — fixed in 1.4.9

How to fix

Upgrade to a fixed version: jahlives openssl_encrypt 1.4.9. Check the vendor advisory for mitigations.

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-539p-fxf4-7fv8
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injection-via-info-command

Get alerted when CVE-2026-81696 or the next vulnerability affects your stack