—

PYSEC-2026-3754

Quick fix

PYSEC-2026-3754 — openssl-encrypt: upgrade to the fixed version with the command below.

pip install --upgrade 'openssl-encrypt>=1.4.0'

Details

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/openssl-encrypt

Introduced in: 0Fixed in: 1.4.0

Fixpip install --upgrade 'openssl-encrypt>=1.4.0'

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-vfgx-5q85-58q3[ADVISORY]
https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-prng-steganography-pixel-selection[ADVISORY]