CVE-2026-67438

Deferred Deferred - Pending Action

Command Injection in OliveTin Web Interface

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c command string and enabling OS command injection. This issue is fixed in version 3000.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67438

Affected Vendors & Products

Vendor	Product	Version / Range
olivetin	olivetin	3000.17.0
olivetin	olivetin	From 3000.2.0 (inc) to 3000.17.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

OliveTin allows users to run predefined shell commands via a web interface. Between versions 3000.2.0 and 3000.17.0, a flaw in the argument safety check lets certain regex-based custom arguments bypass security. This enables attackers to inject malicious commands into shell commands, leading to OS command injection.

Detection Guidance

Check if your OliveTin version is between 3000.2.0 and 3000.17.0. Run: olivetin --version. If affected, update to 3000.17.0 or later immediately.

Impact Analysis

If you use OliveTin in versions 3000.2.0 to 3000.17.0, an attacker with access to the web interface could execute arbitrary commands on the underlying system. This may allow data theft, system compromise, or unauthorized actions depending on the permissions of the OliveTin service.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using affected versions may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade OliveTin to version 3000.17.0 or later. If upgrading is not possible, disable Shell mode actions in the configuration to prevent command injection.

Hi! I’m here to help you understand CVE-2026-67438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70