CVE-2026-53541
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
OliveTin before commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d has a vulnerability that allows arguments whose names start with 'ot_' to bypass the filterToDefinedArgumentsOnly filter. These arguments are not type-checked, are set as environment variables and passed to executed commands, and are also available in the template context.
Risk Assessment
An attacker can pass unvalidated arguments to executed commands, potentially leading to unauthorized actions or privilege escalation.
Recommendation
Apply the patch from commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d or update OliveTin to a version containing the fix.
Other vulnerabilities in OliveTin
See all- CVE-2026-67439Medium
In OliveTin prior to version 3000.17.0, the StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output without enforcing the logs permission, allowing users with exec but not logs permission to read action output.
- CVE-2026-67438Medium
In OliveTin from version 3000.2.0 to 3000.17.0, the checkShellArgumentSafety function does not treat 'regex:' custom argument types as unsafe for Shell mode, allowing OS command injection via interpolation into an sh -c command string.
- CVE-2026-67437High
OliveTin up to version 3000.17.0 stores OAuth2 login states in a map without expiration or size limits, allowing an unauthenticated attacker to exhaust memory and cause a denial of service (DoS).
- CVE-2026-48709Low
OliveTin versions 3000.0.0 and prior allow access to predefined shell commands from a web interface. The ValidateArgumentType RPC endpoint does not perform any authentication or authorization checks, allowing unauthenticated users to enumerate valid action binding IDs and their argument configurations.
- CVE-2026-48708High
OliveTin in versions 3000.0.0 and prior allows access to predefined shell commands from a web interface. The use of a shared template engine instance without synchronization leads to race conditions, resulting in cross-user command contamination and execution errors.
Original NVD description (English source)
OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.