Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

OliveTin Allows Unchecked User Input as Environment Variables

CVE-2026-53541 · published 2 months ago
Summary

OliveTin's configuration allows certain user input to bypass security checks and be set as environment variables for executed commands. This could allow an attacker to inject malicious data or execute unintended actions. To fix this, update OliveTin to properly validate and filter all user input.

What to do
  • Update github.com olivetin to version 0.0.0-20260531214440-ebffd9f040f7.
Affected software
Ecosystem VendorProductAffected versions
go github.com olivetin < 0.0.0-20260531214440-ebffd9f040f7
Fix: upgrade to 0.0.0-20260531214440-ebffd9f040f7
– olivetin olivetin <= 2025.03.07
Original advisory text
OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published21 Aug 2026
Updated4 Nov 2026
First seen24 Jun 2026
Sources
GHSA-prj9-97mp-mwh2 · GHSA
CVE-2026-53541 · NVD
CVE-2026-53541 · MITRE
CVE-2026-53541 · OSV
Track software like this
Free during beta