External risk intelligence

OpenSSL Encrypt Info Command Shell Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81698

This vulnerability exists in a command-line tool or library where the insecure command is generated for manual user execution. It is a client-side or developer-centric utility rather than a public-facing network service or internet-exposed gateway.

OS Command Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in a tool that can allow attackers to inject malicious commands. This occurs when untrusted data is used in a way that allows it to be interpreted as commands, posing a risk if users copy and paste output containing these commands into a shell. The primary concern is confirming if this tool is in use and if its output is ever manually copied into command-line environments.

Input can be crafted to execute commands.
A tool's output could be a vector.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by crafting special metadata that includes shell commands. When a user copies and pastes the output of the `info` command, which includes this crafted metadata, into a shell, the embedded commands would execute. This bypasses the need for direct system access, relying instead on the user to inadvertently trigger the execution.

No entry conditions required.
Triggered by copying output to shell.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

A shell injection vulnerability exists in the `info` command when reconstructing the CLI block. When untrusted metadata fields are interpolated without proper quoting, attackers can craft metadata values containing shell commands that may execute if a user copies and pastes the output into a shell.

System commands could be injected.
Malicious commands may execute upon copy-paste.
Undetermined system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This shell injection vulnerability impacts the `openssl_encrypt` info command, where untrusted metadata fields are interpolated without proper quoting, potentially leading to command execution if a user copies the output into a shell. Determining the scope of impact requires identifying where this tool is used, confirming its reachability and business criticality, and locating the accountable owner. Remediation planning should then be prioritized based on the assessed risk and operational impact.

Identify affected systems and owners.
Verify reachability and business criticality.
Plan remediation or mitigation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is openssl_encrypt?

openssl_encrypt is a software tool or library often used by developers and system administrators to manage encryption tasks. It includes an 'info' command designed to help users interact with metadata. Users typically rely on this utility to generate command-line instructions, which are then manually copied and executed to perform various cryptographic operations.

What does CVE-2026-81698 mean?

This CVE identifies a shell injection vulnerability, classified as CWE-78. The flaw occurs because the software fails to properly format certain metadata fields. When these fields are processed, the program creates a command-line block that contains unquoted, untrusted text. If an attacker controls that text, they can hide malicious system commands inside the output.

How is this vulnerability triggered?

The vulnerability requires a user to interact with the output of the 'info' command. An attacker provides malicious metadata, such as a crafted 'pepper_name', which the tool embeds into its output. The attack only triggers when a user manually copies this generated CLI block and pastes it into their own terminal, causing the hidden commands to execute. It does not trigger if the output is simply viewed or logged.

Is this vulnerability an internet-facing risk?

According to Halo Surface Signal, this is very unlikely to be an internet-facing risk. Because the vulnerability depends on a user manually copying and pasting output from a developer-centric utility, it does not function like a public-facing network service. The primary risk is confined to local environments where users might handle untrusted metadata using this specific tool.

What should I do if I use openssl_encrypt?

First, identify where your team uses this tool and who is responsible for those systems. Since the issue is resolved in version 1.4.9, the most effective step is to update to this version or newer. If you cannot update immediately, ensure that users are trained to inspect command-line strings carefully before pasting them into a shell, especially when those strings contain metadata from untrusted sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.