CVE-2026-74899: Jahlives OpenSSL Encrypt

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

Affected products

• Jahlives OpenSSL Encrypt: before 1.4.0 (fixed in 1.4.0)

Published 2026-08-17. Last modified 2026-08-28.