CVE-2026-53541

Received Received - Intake

Command Injection in OliveTin Web Interface

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53541

Affected Vendors & Products

Vendor	Product	Version / Range
olivetin	olivetin	to ebffd9f040f791208aee1db2e5a8aecd1e3e603d (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

OliveTin provides a web interface to run predefined shell commands. A flaw in the argument filtering function allows user-supplied arguments starting with 'ot_' to bypass security checks. These arguments are not validated, type-checked, or restricted, allowing them to be passed directly to executed commands as environment variables or included in template contexts.

Detection Guidance

To detect this vulnerability, inspect OliveTin configurations for actions using `ot_`-prefixed arguments. Check command execution logs for unvalidated environment variables or template contexts containing `ot_*` arguments. No specific commands are provided in the context.

Impact Analysis

An attacker with access to the web interface could inject malicious commands or environment variables via 'ot_' arguments. This may lead to unauthorized command execution, data exfiltration, or system compromise, depending on the privileges of the OliveTin process.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. It undermines access controls and may result in non-compliance due to potential exposure of sensitive data.

Mitigation Strategies

Update OliveTin to the latest version that includes the patch from commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d to fix the argument filtering issue.

Hi! I’m here to help you understand CVE-2026-53541. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70