CVE-2026-81719

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9

Description Insufficient controls during the execution of untrusted third-party plugins allow for arbitrary code execution with the privileges of the user running the software. This occurs because the plugin signature policy defaults to WARN, enabling the compilation and execution of unsigned or unverifiable non-built-in plugins within the host process at import time, before the runtime sandbox is active. The existing protection relied on an incomplete and bypassable AST (Abstract Syntax Tree) denylist, which is a list of forbidden code patterns used to block malicious syntax.

Recommendations Update to version 1.4.9.