---
id: CVE-2026-81696
aliases:
  - PYSEC-2026-3775
  - GHSA-539p-fxf4-7fv8
title: >-
  openssl_encrypt versions before 1.4.9 fail to sanitize terminal control
  characters in file metadata printed by the info command. Attacker…
summary: >-
  openssl_encrypt versions before 1.4.9 fail to sanitize terminal control
  characters in file metadata printed by the info command. Attackers can craft
  malicious files containing escape sequences to repaint terminal output and
  forge verific…
severity: none
vendor: openssl-encrypt
product: openssl-encrypt
ecosystem: pip
affected:
  - openssl-encrypt < 1.4.9
patched:
  - openssl-encrypt 1.4.9
published: '2026-08-27'
updated: '2026-09-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-3775'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-539p-fxf4-7fv8
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injection-via-info-command
tags:
  - osv
  - pip
epss: 0.0025
epssPercentile: 0.14608
ingestedAt: '2026-09-02T19:31:26.033Z'
---

## Overview

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

## Affected packages

- `openssl-encrypt < 1.4.9`

## Remediation

Upgrade to a patched release:

- `openssl-encrypt 1.4.9`