CVE-2026-74886 affects jahlives openssl_encrypt versions prior to 1.4.0. The vulnerability is caused by a plugin sandbox bypass where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES list. This discrepancy allows attackers to evade AST analysis by using string obfuscation or encoding techniques to import dangerous modules such as sys, shutil, multiprocessing, importlib, and pickle. Exploiting this flaw can lead to arbitrary code execution without requiring privileges or user interaction. The CVSS 4.0 base score is 9.3, indicating a critical severity. No official patch or remediation guidance is currently available.

Successful exploitation allows remote attackers to bypass plugin sandbox restrictions and import dangerous Python modules, enabling arbitrary code execution. This can lead to full compromise of the affected system without requiring privileges or user interaction. The vulnerability is critical due to its high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the vulnerable functionality and monitor for suspicious activity related to plugin imports. Avoid using versions prior to 1.4.0 in untrusted environments.