EUVD-2026-36906
GHSA-7fq5-7wr8-rjwj
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web UI requires a low-privileged authenticated account (PR:L, AV:N); race timing makes exploitation non-deterministic (AC:H); cross-user command execution yields full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case - each ExecRequest spawns a goroutine), a race condition occurs: one goroutine's Parse overwrites the template tree while another goroutine is calling Execute, causing cross-user command contamination, Go runtime panic, and incorrect command execution. This issue has been resolved in version 3000.13.0.
AnalysisAI
Concurrent action execution in OliveTin versions 3000.0.0 and prior triggers a race condition in a shared text/template.Template instance, enabling cross-user command contamination, runtime panics, and execution of unintended commands. Authenticated users of the OliveTin web interface can exploit this by issuing parallel ExecRequests; no public exploit is identified at time of analysis, but the bug manifests during normal multi-user operation. The vendor patched the issue in version 3000.13.0.
Technical ContextAI
OliveTin is a self-hosted Go application that exposes a web UI for triggering predefined shell commands. The vulnerable code path lives in service/internal/tpl/templates.go, where a package-level tpl variable holds a single text/template.Template that is mutated by tpl.Parse(source) and then read by t.Execute() without any mutex or per-request template clone. Each incoming ExecRequest spawns its own goroutine, so the shared mutable parse tree is concurrently written and read - the textbook CWE-362 concurrent execution using shared resource with improper synchronization (race condition). When two goroutines interleave, one action's parsed template is executed by another action's Execute call, producing cross-user command contamination.
RemediationAI
Vendor-released patch: upgrade to OliveTin 3000.13.0 or later (commit d74da9314005954dd49fa20dabf272247bc76519, advisory GHSA-7fq5-7wr8-rjwj at https://github.com/OliveTin/OliveTin/security/advisories/GHSA-7fq5-7wr8-rjwj); container users should pull ghcr.io/olivetin/olivetin:3000.13.0 or docker.io/jamesread/olivetin:3000.13.0. The release notes confirm no breaking changes between the prior release and 3000.13.0, so the upgrade is low-risk. If immediate upgrade is impossible, restrict access to the OliveTin web interface to a single trusted operator (eliminating concurrent ExecRequests removes the race window) and place the instance behind an authenticating reverse proxy that serializes requests - both controls degrade the multi-user UX OliveTin is designed for, so they are stopgaps rather than long-term fixes. Auditing recently executed actions for anomalous commands is advisable since the race can silently substitute one user's command for another.
OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat
OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s
OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut
OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a
OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today