CVE-2026-74899 affects jahlives openssl_encrypt versions prior to 1.4.0. The vulnerability arises from improper neutralization of directives in dynamically evaluated code, specifically in the IsolatedPluginExecutor component. Attackers can exploit this by accessing Python type objects exposed in restricted exec() builtins and traversing the class hierarchy via __class__.__mro__.__subclasses__() to reach system functions. This leads to arbitrary OS command execution, effectively escaping the sandbox environment.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands on the affected system without user interaction, leading to full system compromise. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been disclosed at this time. Users should monitor the vendor's communications for updates and avoid using vulnerable versions if possible.