CVE-2026-81697: Untrusted Search Path in jahlives openssl_encrypt

CVE-2026-81697 describes a vulnerability in the openssl_encrypt Python package (versions <= 1.4.8) where the crypt_settings.py module reassigns the CONFIG_FILE variable from an absolute path (~/.crypt_settings.json) to a relative filename ('crypt_settings.json'). This causes the legacy Tk GUI's SettingsTab to read and write KDF settings from the current working directory instead of the user's home directory. An attacker who places a malicious crypt_settings.json file in the process launch directory can disable memory-hard KDFs, effectively downgrading encryption strength to roughly one hash round. This bypasses the weak-KDF preflight check and facilitates offline brute-force attacks against encrypted data. The vulnerability is resolved in version 1.4.9.

An attacker with the ability to place a malicious crypt_settings.json file in the working directory can silently weaken the key derivation function settings used by the GUI, reducing encryption strength significantly. This enables offline brute-force attacks on ciphertext that would otherwise be protected by stronger KDF parameters. The vulnerability does not require privileges or user interaction and can be exploited remotely if the attacker can influence the working directory contents. There are no known exploits in the wild as of the publication date.

Upgrade to openssl_encrypt version 1.4.9 or later, where this vulnerability is fixed. Until then, avoid running the legacy Tk GUI in directories writable by untrusted users or where an attacker can place a malicious crypt_settings.json file. There is no indication that other mitigations or workarounds are effective.