CVE-2026-81694
Low · 3.3CVSS
3.3
EPSS
0.3%
Published
Aug 27, 2026
CISA due date
—
The record
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109786 In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter… CWE-117
- CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. CWE-117
- CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an… CWE-117
- CVE-2026-9736 IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to… CWE-117
- CVE-2026-15603 morgan is an HTTP request logger middleware for Node.js. CWE-117
- CVE-2026-81695 openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values… CWE-117
- CVE-2026-81696 openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in… CWE-117
- CVE-2026-54511 LogTape is an unobtrusive logging library. CWE-117