openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block. The vulnerability arises because untrusted metadata fields are interpolated without proper quoting. Attackers can craft malicious metadata values, such as a pepper_name field containing shell commands. These commands execute when a user copies the printed CLI block into a shell session. The vulnerability is classified as a shell injection issue and affects all versions prior to 1.4.9. Users are advised to upgrade to version 1.4.9 or later to remediate the risk. The issue is tracked as CVE-2026-81698 and has been reported via GitHub Security Advisories and VulnCheck.