Skip to content
cve.newCreate a CVE report

openssl-encrypt

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

critical9.3
CVE-2026-81694

openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

jahlives · openssl_encrypt