CVE-2026-81719

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running openssl_encrypt. Fixed in 1.4.9 by defaulting the signature policy to ENFORCE for non-built-in plugins.

• CWE-94

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-587j-4r3v-cm2cVendor Advisory
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-remote-code-execution-via-pluginThird Party Advisory

Published

Aug 27, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81707openssl_encrypt before 1.4.9 fails to sanitize the email fie…9.8
• CVE-2026-81714openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use…7
• CVE-2026-81715openssl_encrypt (pip package openssl-encrypt) versions <= 1.…3.3
• CVE-2026-81716openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9…5.2
• CVE-2026-81717openssl_encrypt (pip package openssl-encrypt) before 1.4.9 c…3.5
• CVE-2026-81718openssl_encrypt versions before 1.4.9 use under-parameterize…7.5
• CVE-2026-8172The Simple Basic Contact Form WordPress plugin through 20250…7.1
• CVE-2026-81720openssl_encrypt before 1.4.9 fails to validate the memory_co…6.2
• CVE-2026-81721openssl_encrypt before 1.4.9 fails to validate KDF cost para…7.5
• CVE-2026-81722nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) c…7.5
• CVE-2026-81723NLTK versions before 3.10.3 contain a quadratic CPU exhausti…3.7
• CVE-2026-81724NLTK before 3.10.3 contains an uncontrolled recursion vulner…5.3