Root cause
Other / insufficient public mechanism detail introduced
The AI-assisted change moved plugin screening to an AST visitor that flagged dangerous functions, imports and getattr patterns, but no check covered dunder attribute traversal.
An AI-assisted change replaced the plugin regex checks with an AST analyzer whose visitor lists dangerous functions and modules, so plugin code could still walk dunder attributes to reach blocked functions.
How AI contributed: Direct introductionPublished Feb 10, 2026 in 
jahlives/openssl_encryptAll 20 findings in this repository
Show full advisory descriptionHide advisory description
Plugin code is scanned by the AST analyzer before the plugin is loaded. The AI-assisted change taught the visitor to flag dangerous calls such as eval, exec and compile, imports such as subprocess and socket, os functions such as system and popen, and getattr calls that resolve blocked names through __builtins__. It did not flag attribute access, so a plugin could start from any object it already held, walk through __class__, __bases__ and __subclasses__() into the loaded modules, and pick up references to subprocess or os to run commands outside the intended restrictions. The repair adds the escape-enabling dunder names to the visitor and reports attribute access, getattr targets, and __subclasses__() calls, so the traversal chain is rejected before the plugin runs.
What actually happenedHide details
The plugin manager validates plugin source before loading it, and the new AST visitor records violations for dangerous calls, forbidden imports, and getattr lookups aimed at __builtins__. Attribute access itself was only checked for those builtins names, so a plugin could chain __class__, __bases__ and __subclasses__() to walk the type hierarchy, collect references to the very functions the sandbox blocks, and call them to run system commands. The repair adds a denylist of dunder attributes and reports attribute access, getattr targets, and __subclasses__() calls.
Fix
Security fix
The analyzer now blocks dunder attribute names, including lookups made through getattr and __subclasses__() calls, so plugin code cannot walk the type hierarchy to reach blocked functions.
AI-assisted fix: Claude Code · Tobi
Case facts
- CVE ID
- CVE-2026-74896
- GHSA ID
- GHSA-W7GR-9G4G-33MX
- Published
- Feb 10, 2026
- Severity
- Not scored
- Language
- Python
- AI tool
Claude- AI role
- Direct introduction
- Vulnerable release
- < 1.4.0
- Fixed release
- v1.4.0
AI-assisted change
AI-assisted changeopenssl_encrypt/modules/plugin_system/plugin_ast_analyzer.pysource jahlives/openssl_encrypt@50bec5d365+28−0
@@ -0,0 +37,28 @@+class DangerousPatternVisitor(ast.NodeVisitor):+ """+ AST visitor that detects dangerous security patterns in plugin code.+Show 24 hidden lines
+ This visitor traverses the Abstract Syntax Tree of plugin code and identifies+ potentially dangerous operations that could bypass sandbox restrictions.+ """++ # Functions that are always dangerous+ DANGEROUS_FUNCTIONS = {+ 'eval', 'exec', 'compile', '__import__',+ 'open', # Checked separately for path safety+ }++ # Modules that should never be imported+ DANGEROUS_MODULES = {+ 'subprocess', 'os', 'socket', 'ctypes', 'multiprocessing',+ 'importlib', '__builtin__', '__builtins__', 'sys', 'shutil',+ 'pickle', 'shelve', 'commands', 'pty', 'fcntl', 'pwd', 'grp',+ 'signal', 'resource', 'pipes', 'popen2', 'platform'+ }++ # os module functions that are dangerous+ DANGEROUS_OS_FUNCTIONS = {+ 'system', 'popen', 'spawn', 'exec', 'fork', 'kill', 'killpg',+ 'spawnl', 'spawnle', 'spawnlp', 'spawnlpe',+ 'spawnv', 'spawnve', 'spawnvp', 'spawnvpe'+ }the visitor enumerates the dangerous calls, imports and os functions, and nothing in it inspects the dunder attributes used for type hierarchy traversal.
Security fix
Fixopenssl_encrypt/modules/plugin_system/plugin_ast_analyzer.pysource jahlives/openssl_encrypt@993cd13d58+17−0
@@ -56,6 +56,23 @@ class DangerousPatternVisitor(ast.NodeVisitor): "__import__", } + # Dunder attributes that enable type hierarchy traversal / sandbox escape.+ # Note: __init__, __new__, __del__, __dict__, __func__, __self__, __class__+ # are NOT included here because they are standard Python and commonly used+ # in legitimate plugin code. Only attributes that enable sandbox escapesShow 16 hidden lines
+ # (type hierarchy traversal, scope access, code manipulation, pickle exploits)+ # are blocked.+ DANGEROUS_DUNDER_ATTRIBUTES = {+ "__mro__",+ "__subclasses__",+ "__bases__",+ "__globals__",+ "__builtins__",+ "__code__",+ "__reduce__",+ "__reduce_ex__",+ }+ # Modules that should never be imported # Note: 'os' and 'socket' are NOT blocked here: # - 'os' is needed for path operations; file access is restricted by sandbox allowed_pathsan explicit list of escape-enabling dunder attributes that the visitor checks on attribute access and on getattr lookups.
Patch fingerprints
AI-assisted change 69ded809381ba83f2f28ebae58e4c5dad2908189445ac9df34ee4c250dca6378 · Fix f86c93b3a22c0e5ea364a16e85bc729469ea1d125a6885ef03cbf2389ee13d93