OliveTin gives access to predefined shell commands from a web interface

Overview

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with ot_ to bypass this filter. While two system arguments (ot_executionTrackingId and ot_username) are injected by OliveTin and overridden, all other ot_-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so ot_-prefixed arguments skip all type safety checks entirely; set as environment variables — via buildEnv(), with completely unvalidated values, and passed to the executed command; and included in the template context — available as .Arguments.ot_* in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-53541)

Affected packages:

• github.com/OliveTin/OliveTin < 0.0.0-20260531214440-ebffd9f040f7

Patched in:

• github.com/OliveTin/OliveTin 0.0.0-20260531214440-ebffd9f040f7

Source: https://github.com/advisories/GHSA-prj9-97mp-mwh2