Sandbox Bypass in openssl_encrypt Plugin File Access

CVE-2026-74883 represents a critical sandbox escape in openssl_encrypt versions before 1.4.0, where the plugin's file access restrictions can be completely circumvented through alternative Python modules. Instead of relying on the restricted_open function, attackers can import pathlib.Path or io.open directly to read and write arbitrary files on the system. This vulnerability affects any deployment using vulnerable openssl_encrypt versions in environments where untrusted code execution is possible—including CI/CD pipelines, containerized applications, and multi-tenant platforms. The high CVSS score of 8.8 reflects the severity: complete bypass of intended security controls enables unauthorized data exfiltration, configuration manipulation, and potential lateral movement within affected systems.

While CVE-2026-74883 has no explicit MITRE ATT&CK mapping, Casky's extended reasoning capabilities would detect the attack patterns underlying this vulnerability by identifying suspicious module imports and file operations. A practitioner using Casky would observe findings related to T1087 (Account Discovery) and T1083 (File and Directory Discovery) if attackers enumerate system files, combined with T1020 (Automated Exfiltration) when unauthorized read operations occur. Casky's Claude-powered analysis would flag the behavioral pattern of importing io or pathlib modules in contexts where they shouldn't be accessible, correlate this with subsequent file access outside the plugin's intended scope, and surface the sandbox bypass mechanism itself as a control evasion indicator. This detection approach complements the 0 currently mapped skills by providing threat hunters with the contextual reasoning needed to identify exploitation before data loss occurs.