---
id: CVE-2026-53541
title: OliveTin gives access to predefined shell commands from a web interface
summary: >-
  OliveTin gives access to predefined shell commands from a web interface. The
  `filterToDefinedArgumentsOnly` function in the executor is intended to discard
  any arguments not explicitly defined in the action's configuration. However,
  prio…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-20
vendor: OliveTin
product: github.com/OliveTin/OliveTin
affected:
  - github.com/OliveTin/OliveTin < 0.0.0-20260531214440-ebffd9f040f7
patched:
  - github.com/OliveTin/OliveTin 0.0.0-20260531214440-ebffd9f040f7
published: '2026-08-21'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:06:39.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53541'
references:
  - url: >-
      https://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d
    label: security-advisories@github.com
  - url: >-
      https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2
    label: security-advisories@github.com
  - url: >-
      https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-prj9-97mp-mwh2'
tags:
  - nvd
  - ghsa
  - go
epss: 0.00275
epssPercentile: 0.20175
ecosystem: go
ingestedAt: '2026-06-26T16:43:14.251Z'
---

## Overview

OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53541)

Affected packages:

- `github.com/OliveTin/OliveTin < 0.0.0-20260531214440-ebffd9f040f7`

Patched in:

- `github.com/OliveTin/OliveTin 0.0.0-20260531214440-ebffd9f040f7`

Source: https://github.com/advisories/GHSA-prj9-97mp-mwh2