CVE-2026-81698 is a high severity (CVSS 7.5 in the record) shell injection flaw in openssl_encrypt versions before 1.4.9. The info command prints a reconstructed command line that includes unquoted metadata fields from an encrypted file. Copying it into a shell can run injected commands. Upgrade to 1.4.9.
What's affected
- openssl_encrypt (the pip package openssl-encrypt) 1.4.8 and earlier. The GitHub advisory lists affected versions as 1.4.8 or lower, and VulnCheck lists anything below 1.4.9.
- Fixed in 1.4.9. The advisory says every interpolated value now passes through shlex.quote.
- The advisory says the issue affects both the 1.4.x and 1.5.x lines.
Record severity: CVSS 7.5 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-78, OS Command Injection.
Source note: Severity differs by source. The record scores it CVSS 7.5 (High). The GitHub advisory rates it Moderate and at that time said it had no CVE id. VulnCheck lists CVSS v4 9.3. All agree 1.4.9 fixes it.
How to check if you're exposed
Run pip show openssl-encrypt and read the Version line. Check requirements files and lock files for the package. You can also paste a lock file into the free scanner at gold.safeguard.sh/scan. Then ask whether anyone on your team opens encrypted files from others and copies the printed command block into a shell.
What to do now
- Search environments and lock files for openssl-encrypt.
- Upgrade with
pip install -U "openssl-encrypt>=1.4.9". - Until then, do not paste the reconstructed command block from the info command into a shell for files you do not trust.
- Rebuild images and pipelines that include the package.
- Tell users to read command text before running it.
Why it matters
Shell injection (CWE-78) arises when values are placed in command text without quoting, so a value can end its argument and add new commands. Here the printed block is meant to be copied and run, which is what makes the issue reachable. The user takes the final step, which is why the record has user interaction set in its vector.
The fix is straightforward: quote every value. Command lines that tools print for users to run deserve the same care as commands a program runs itself. The record does not mark the CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version is fixed?
1.4.9.
Is the attack automatic?
No. The attacker relies on a user copying the printed block into a shell.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
