CVE-2026-81684: Invocation of Process Using Visible Sensitive Information in jahlives openssl_encrypt
Description
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
CVSS v4.0
Score 6.9medium
Affected software
jahlives
openssl_encrypt
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In openssl_encrypt versions up to 1.4.8, the desktop GUI component invokes a CLI child process passing the steganography password on the command line using the --stego-password argument. This approach exposes the password in the /proc/<pid>/cmdline file for the subprocess lifetime, allowing any local user on the system to read the sensitive password. The main password is passed securely via environment variables, but the steganography password is not. This issue was addressed and fixed in version 1.4.9.
Potential Impact
Local users on the affected system can obtain the steganography password by reading the command line arguments of the subprocess, potentially compromising the confidentiality of encrypted data that relies on this password. There is no indication of remote exploitation or privilege escalation. The impact is limited to local information disclosure.
Mitigation Recommendations
Upgrade to openssl_encrypt version 1.4.9 or later, where the vulnerability is fixed by no longer passing the steganography password on the command line. No other mitigation is required as the fix is official and available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-27T11:11:30.934Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a906bb5acd9273b4983a1f4
Added to database: 08/27/2026, 16:54:13 UTC
Last enriched: 10/02/2026, 15:55:00 UTC
Last updated: 10/11/2026, 18:48:22 UTC
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.