Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-81696: jahlives openssl_encrypt can show forged verification info
CVE-2026-81696 · published 2 months ago
Summary
Versions of jahlives openssl_encrypt released before 1.4.9 can be tricked into showing false verification details on the screen. An attacker can embed special characters in a file so that, when the info command is run, the terminal display is altered and the output appears trustworthy. Update to version 1.4.9 or later, or avoid using the info command on untrusted files.
What to do
- Update jahlives openssl_encrypt to version 1.4.9 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
Original advisory text
openssl_encrypt before 1.4.9 Terminal Injection via info Command
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-539p-fxf4-7... Vendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injec... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81696... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-81696 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-117Improper Output Neutralization for Logs
Timeline
Published27 Aug 2026
Updated4 Nov 2026
First seen27 Aug 2026
Track software like this
Free during beta