CVE-2026-74896
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- 0.34%
- 26th pct
- KEV
- No
- Class
- oss containerizable
- CWE-693
Description
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.
References
Status: profiled · ingested 2026-09-01T18:00:49.000Z