{"id":"CVE-2026-53541","title":"OliveTin gives access to predefined shell commands from a web interface","summary":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prio…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-20"],"vendor":"OliveTin","product":"github.com/OliveTin/OliveTin","affected":["github.com/OliveTin/OliveTin < 0.0.0-20260531214440-ebffd9f040f7"],"patched":["github.com/OliveTin/OliveTin 0.0.0-20260531214440-ebffd9f040f7"],"published":"2026-08-21","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:06:39.057","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53541","references":[{"url":"https://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d","label":"security-advisories@github.com"},{"url":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2","label":"security-advisories@github.com"},{"url":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-prj9-97mp-mwh2"}],"tags":["nvd","ghsa","go"],"epss":0.00275,"epssPercentile":0.20135,"ecosystem":"go","ingestedAt":"2026-06-26T16:43:14.251Z","slug":"CVE-2026-53541","body":"## Overview\n\nOliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-53541)\n\nAffected packages:\n\n- `github.com/OliveTin/OliveTin < 0.0.0-20260531214440-ebffd9f040f7`\n\nPatched in:\n\n- `github.com/OliveTin/OliveTin 0.0.0-20260531214440-ebffd9f040f7`\n\nSource: https://github.com/advisories/GHSA-prj9-97mp-mwh2","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}