Olivetin
CVE-2026-27626
CRITICAL
GHSA-49gm-hh7w-wfvf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (checkShellArgumentSafety) blocks several dangerous argument types but not password. A user supplying a password-typed argument can inject shell metacharacters that execute arbitrary OS commands. A second independent vector allows unauthenticated RCE via webhook-extracted JSON values that skip type safety checks entirely before reaching sh -c. When exploiting vector 1, any authenticated user (registration enabled by default, authType: none by default) can execute arbitrary OS commands on the OliveTin host with the permissions of the OliveTin process. When exploiting vector 2, an unauthenticated attacker can achieve the same if the instance receives webhooks from external sources, which is a primary OliveTin use case. When an attacker exploits both vectors, this results in unauthenticated RCE on any OliveTin instance using Shell mode with webhook-triggered actions. As of time of publication, a patched version is not available.
AnalysisAI
OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to predefined shell commands — the injection allows executing arbitrary commands beyond the whitelist. PoC available.
Technical ContextAI
CWE-78 in OliveTin up to 3000.10.0. The tool is designed to expose specific predefined commands via web UI — the injection allows breaking out to execute arbitrary commands.
RemediationAI
Update OliveTin. Implement strict argument sanitization.
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat
OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s
OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut
OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a
OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t
Concurrent action execution in OliveTin versions 3000.0.0 and prior triggers a race condition in a shared text/template.
Same weakness CWE-78 – OS Command Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today