PYSEC-2026-3774

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81695

openssl_encrypt versions before 1.4.9 are affected by a terminal injection vulnerability. During decrypt auto-detection, attacker-controlled key_id values are printed to stderr without proper escaping, allowing an attacker to craft encrypted files containing escape sequences that repaint terminal...