Description

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T11:16:44.787Z",
  "pubdate": "2026-08-17T11:16:44.787Z",
  "executiveSummary": "A sandbox escape vulnerability exists in openssl_encrypt versions prior to 1.4.0, specifically within the DangerousPatternVisitor Abstract Syntax Tree (AST) analyzer component.\nThe vulnerability stems from the analyzer's failure to adequately detect and restrict dunder attribute traversal techniques, allowing malicious actors to bypass established sandbox restrictions.\nSuccessful exploitation of this flaw enables attackers with the ability to execute arbitrary system commands from within untrusted plugin code.\nThe impact includes complete compromise of the application execution environment, potential lateral movement, and unauthorized access to underlying operating system resources.\nAttackers achieve this by crafting specialized AST payloads utilizing built-in Python reflection chains to access restricted functions and execute system-level operations.\nThe affected product is openssl_encrypt for all versions prior to 1.4.0, posing significant risk implications for environments executing third-party or plugin-based scripts.",
  "technicalDetails": "The root cause of the vulnerability resides in the DangerousPatternVisitor AST analyzer, a component responsible for parsing and validating plugin code before execution within openssl_encrypt versions prior to 1.4.0.\nDuring the static analysis phase, the DangerousPatternVisitor fails to properly identify and block dunder attribute traversal techniques intended to bypass sandbox boundaries.\nAttackers exploit this limitation by constructing payload chains that leverage Python reflection mechanisms, specifically utilizing attributes such as __class__, __bases__, __subclasses__(), and __globals__.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious plugin containing an Abstract Syntax Tree structure that invokes dunder attributes to navigate the object hierarchy of runtime classes.\nSecond, the plugin is submitted to the application utilizing openssl_encrypt for execution. Because the DangerousPatternVisitor fails to flag the dunder attribute traversal patterns, the AST analyzer incorrectly authorizes the code.\nThird, upon execution, the reflection chain successfully traverses from restricted plugin scopes to built-in modules and restricted functions, bypassing the intended sandbox isolation.\nFinally, the attacker leverages these accessed restricted functions to invoke system-level execution routines, resulting in arbitrary system command execution with the privileges of the host process.\nNo authentication or elevated privilege requirements are inherently specified beyond the ability to supply or execute plugin code within the application context.\nThe vulnerability is exposed locally wherever untrusted plugin code is processed and analyzed by the vulnerable DangerousPatternVisitor component."
}