CVE-2026-81719: Improper Control of Generation of Code ('Code Injection') in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt prior to version 1.4.9 involves improper control over the generation of code via execution of untrusted third-party plugins. The default plugin signature policy was set to WARN, which permitted unsigned or unverifiable plugins to be compiled and executed in the host process at import time, before the runtime sandbox was applied. The only protection was an incomplete and bypassable abstract syntax tree (AST) denylist. If an attacker convinces a user to load a malicious plugin, arbitrary code execution can occur with the user's privileges. The issue is resolved in version 1.4.9 by changing the default plugin signature policy to ENFORCE for non-built-in plugins, preventing execution of unverified code.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running openssl_encrypt. This can lead to full compromise of the affected system under the user's context. The vulnerability does not require user interaction beyond loading a malicious plugin and has no known exploits in the wild as of the publication date.

Upgrade to jahlives openssl_encrypt version 1.4.9 or later, where the default plugin signature policy is set to ENFORCE for non-built-in plugins, effectively preventing execution of unsigned or unverifiable plugins. Until the upgrade, avoid loading third-party plugins from untrusted sources. Patch status is confirmed fixed in version 1.4.9.