---
id: CVE-2026-74883
aliases:
  - PYSEC-2026-3760
  - GHSA-mcjj-qw7m-j3cp
title: >-
  openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability
  where the plugin sandbox fails to restrict alternative file …
summary: >-
  openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability
  where the plugin sandbox fails to restrict alternative file access methods
  like pathlib.Path and io.open. Attackers can import pathlib or io modules to
  read and…
severity: none
vendor: openssl-encrypt
product: openssl-encrypt
ecosystem: pip
affected:
  - openssl-encrypt < 1.4.0
patched:
  - openssl-encrypt 1.4.0
published: '2026-08-17'
updated: '2026-09-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-3760'
references:
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-sandbox-bypass-via-pathlib-and-io
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-mcjj-qw7m-j3cp
tags:
  - osv
  - pip
epss: 0.00476
epssPercentile: 0.38552
ingestedAt: '2026-09-02T19:31:25.414Z'
---

## Overview

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

## Affected packages

- `openssl-encrypt < 1.4.0`

## Remediation

Upgrade to a patched release:

- `openssl-encrypt 1.4.0`