Arbitrary Code Execution in openssl_encrypt Library

The openssl_encrypt Python package, specifically versions prior to 1.4.0, contains an arbitrary code execution vulnerability (CVE-2026-74872) located within its Whirlpool hash implementation. The library attempts to load shared object (.so) modules using overly broad glob patterns without performing any integrity or authenticity checks. An attacker capable of writing files to the Python site-packages directory can place a malicious shared object file that matches the pattern 'whirlpoolpy313.so'. When the openssl_encrypt library is imported or the specific hash function is invoked, the Python interpreter loads the malicious .so file, resulting in native code execution under the context of the running process. This issue is categorized as CWE-426: Untrusted Search Path.

Impact

The vulnerability carries a CVSS v3.1 score of 9.8 (Critical). Successful exploitation allows unauthenticated remote or local attackers to achieve arbitrary code execution on systems where the library is present and the site-packages directory is writable. This exposes applications to full system compromise, data theft, and persistence, particularly in environments where automated installers or CI/CD pipelines might inadvertently grant attackers write access to site-packages.

Recommendation

• Upgrade the 'openssl_encrypt' package to version 1.4.0 or later across all Python environments.
• Audit existing Python site-packages directories for any files matching the pattern 'whirlpoolpy313.so' that were not installed by the official package manager.
• Implement file integrity monitoring on Python library installation paths to detect unauthorized creation of .so files.
• Enforce strict file system permissions on 'site-packages' directories to prevent non-privileged users from modifying or adding library files.