CVE-2026-81696: openssl_encrypt before 1.4.9 Terminal Injection via info Command
opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of openssl_encrypt before 1.4.9 are exposed when they run the info command on attacker-controlled or otherwise untrusted files. The issue affects terminal output generated from file metadata.
What does an attacker need to exploit it?
An attacker needs to provide a malicious file whose metadata contains terminal escape sequences and induce a user to view it with the info command. No privileges are required, but user interaction is required.
Are confidentiality or availability affected?
The reported impact is limited to integrity of terminal-displayed information. The supplied severity vector indicates no confidentiality or availability impact.
What should be done if updating is not immediately possible?
Avoid running the info command on untrusted files or treat its output as untrusted until the software can be updated to version 1.4.9 or later.