CVE-2026-81694— verify-usb before 1.4.9 Output Injection via Unsanitized Filenames
Quick assessment
Affected
jahlives openssl_encrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
openssl-encrypt（pip 包，版本 ≤ 1.4.8）在打印 命令的输出时，未能对从不可信磁盘数据（位于 AES-GCM 认证清单之外）读取的文件名进行清理/转义。攻击者可以植入包含终端光标移动和擦除行控制字节的文件名，从而在屏幕上重新绘制出一个伪造的“通过（PASSED）”判定结果，以此掩盖实际的篡改检测。该问题已在 1.4.9 版本中通过让源自磁盘的名称经过 函数处理而得到修复。
Possible ATT&CK Techniques 1 AI
T1564.003 · Hidden WindowAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
affected |
1.4.9 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81694
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
verify-usb before 1.4.9 Output Injection via Unsanitized Filenames
Source: CVE Program / CVE List V5
Vulnerability Description
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
日志输出的转义处理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jahlives | openssl_encrypt | 0 ~ 1.4.9 | - |
|
II. Public POCs for CVE-2026-81694
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81694
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81694 (2)
Same Patch Batch · jahlives · 2026-08-27 · 36 CVEs total
| CVE-2026-81707 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email |
| CVE-2026-81702 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Key Substitution via Identity Load |
| CVE-2026-81700 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 GPG Signature Verification Bypass |
| CVE-2026-81701 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin |
| CVE-2026-81683 | 8.4 HIGH | openssl_encrypt before 1.4.9 Plaintext Private Key Storage |
| CVE-2026-81719 | 7.8 HIGH | openssl_encrypt before 1.4.9 Remote Code Execution via Plugin |
| CVE-2026-81704 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus |
| CVE-2026-81692 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO |
| CVE-2026-81699 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost |
| CVE-2026-81689 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Pepper Key Derivation |
| CVE-2026-81705 | 7.5 HIGH | openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug |
| CVE-2026-81718 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Cryptographic Parameters |
| CVE-2026-81688 | 7.5 HIGH | openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 |
| CVE-2026-81693 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via QR total field |
| CVE-2026-81691 | 7.5 HIGH | openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs |
| CVE-2026-81698 | 7.5 HIGH | openssl_encrypt before 1.4.9 Shell Injection via info command |
| CVE-2026-81721 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via KDF |
| CVE-2026-81690 | 7.3 HIGH | verify-usb before 1.4.9 Symlink Directory Traversal Code Execution |
| CVE-2026-81714 | 7.0 HIGH | openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass |
| CVE-2026-81706 | 6.8 MEDIUM | openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: openssl_encrypt
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same vendor: jahlives
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same weakness: CWE-117
-
CVE-2026-15603
morgan vulnerable to Log Forging via unescaped Unicode line -
CVE-2026-81696
openssl_encrypt before 1.4.9 Terminal Injection via info Com -
CVE-2026-81695
openssl_encrypt before 1.4.9 Terminal Injection via key_id -
CVE-2026-44256
Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Usernam -
CVE-2026-74885
openssl_encrypt before 1.4.0 Logging Bug and Race Condition
V. Comments for CVE-2026-81694
No comments yet