What is CVE-2026-74899?
CVE-2026-74899 is a sandbox escape vulnerability in openssl_encrypt versions before 1.4.0 that exposes Python type objects via restricted exec() builtins in IsolatedPluginExecutor. Attackers can traverse the class hierarchy using __class__.__mro__.__subclasses__() to access system functions and execute arbitrary commands, so updating to version 1.4.0 or later is recommended.
Azərbaycanca: CVE-2026-74899, openssl_encrypt modulunun 1.4.0-dan əvvəlki versiyalarında IsolatedPluginExecutor sandbox qaçış zəifliyidir. Bu zəiflik məhdud exec() mühitində Python sinif iyerarxiyasına çıxış əldə etməyə imkan verir, təcavüzkarlara sistem funksiyalarına daxil olub ixtiyari əmrlər icra etməyə şərait yaradır. Modulu ən azı 1.4.0 versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-94
FAQ2
Which versions of the openssl_encrypt module are affected by CVE-2026-74899?
This vulnerability affects all versions of the openssl_encrypt module prior to 1.4.0.
What method can an attacker use to exploit CVE-2026-74899?
An attacker can traverse the Python class hierarchy using the __class__.__mro__.__subclasses__() chain through restricted exec() in the IsolatedPluginExecutor sandbox to access system functions.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.