CVE-2026-81698: openssl_encrypt before 1.4.9 Shell Injection via info command
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the printed CLI block into a shell.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Compensating control
Do not copy the printed CLI block generated by the openssl_encrypt info command into a shell; treat reconstructed CLI output as untrusted due to shell injection when untrusted metadata (e.g., pepper_name) is interpolated without quoting.
Event History
Frequently Asked Questions
What user action is required for exploitation?
A user must run the info command and copy the reconstructed CLI block it prints into a shell. The injected metadata is executed only when that displayed command is pasted or otherwise run by the user.
Who is exposed to this issue?
Users of openssl_encrypt versions before 1.4.9 are exposed when they process attacker-crafted metadata and use the info command's printed CLI reconstruction. No attacker privileges are required, but user interaction is required.
Which metadata should be treated as dangerous?
Untrusted metadata fields interpolated into the reconstructed CLI block are dangerous, including fields such as pepper_name. Metadata values can contain shell commands if they are not quoted before being printed.