CVE-2026-81696: jahlives openssl_encrypt

CVSS 9.3 (critical) · published 2026-08-27

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

Affected products (NVD): jahlives openssl_encrypt

Fixed in (NVD): 1.4.9

Weakness: CWE-117

Source: NVD CVE-2026-81696

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-539p-fxf4-7fv8
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injection-via-info-command

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.