Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-hw7h-wqf5-6crx

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not de...

CVSS 8.7 HighEPSS 0.0071 · 53rd percentile

Published by the GitHub Advisory Database at 27 Aug 2026, 17:20 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
openssl-encryptPyPI<1.4.91.4.9
Identifiers
GHSA-hw7h-wqf5-6crx · CVE-2026-81690 · PYSEC-2026-3796
Weakness (CWE)
CWE-59
Tags
Published
27 Aug 2026
Updated
3 Sept 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

openssl-encrypt before 1.4.9 has a symlink-following flaw in its verify-usb v2 scan, so tampered drives can pass verification. An attacker with physical access to the removable drive can plant a file that runs when the victim uses the portable install. Upgrade to openssl-encrypt 1.4.9.

Written 5 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.7 High 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CNA (VulnCheck)
  • CISA KEV Not listed.
  • EPSS 0.0071, the 53rd percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 31 Oct 2026, 14:38 UTC First seen by agentprime
  2. 31 Oct 2026, 14:38 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.