CVE-2026-81690: Improper Link Resolution Before File Access ('Link Following') in jahlives openssl_encrypt

The vulnerability in openssl-encrypt (pip package) before 1.4.9 arises from a symlink-following flaw in the verify-usb v2 added-file allowlist scan. The scan uses rglob() which in CPython treats symlinked directories as ordinary directories without descending into them, while the O_NOFOLLOW flag only applies to the final path component. An attacker with physical access to a removable drive can replace a directory with a symlink pointing to a copy containing byte-identical files plus a malicious __pycache__/*.pyc file. Since CPython loads .pyc files preferentially, the malicious code executes when the victim runs the portable install. The planted file is not enumerated, so the verification passes incorrectly. This issue affects versions before 1.4.9 and was fixed in 1.4.9.

An attacker with physical access to a removable drive can exploit this vulnerability to execute arbitrary code on the victim's system when the portable install is run. This occurs because the verification process incorrectly passes due to improper symlink handling, allowing malicious .pyc files to be loaded by CPython.

Upgrade to version 1.4.9 or later of the openssl-encrypt package, where this vulnerability is fixed. No other mitigations are specified or recommended by the vendor.