CVE-2026-74896 is a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer component of jahlives openssl_encrypt prior to version 1.4.0. The vulnerability arises because the analyzer does not detect traversal via Python's dunder attributes (__class__, __bases__, __subclasses__(), __globals__), enabling attackers to break out of sandbox restrictions. This can lead to arbitrary system command execution from within plugin code, posing a critical security risk.

Successful exploitation allows an unauthenticated attacker to bypass sandbox restrictions and execute arbitrary system commands on the host running vulnerable versions of openssl_encrypt. This can lead to full system compromise, data breach, or further malicious activity. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications closely and avoid using vulnerable versions (<1.4.0) in untrusted environments. Restrict plugin code execution privileges and consider disabling or sandboxing the vulnerable component until a fix is available.