EUVD-2026-50564
GHSA-xc5w-4v5w-7x65
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
AC:H captures the required non-default Shell-mode plus regex: config; PR:L reflects that any authenticated OliveTin user invoking the action can exploit it, not only admins.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c command string and enabling OS command injection. This issue is fixed in version 3000.17.0.
AnalysisAI
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary shell commands by supplying a crafted argument value to a Shell-mode action that uses a custom regex: argument type. The root cause is that checkShellArgumentSafety in service/internal/executor/arguments.go omitted regex: types from its unsafe-argument blocklist, permitting regex-validated values to be interpolated unsanitized into an sh -c command string via wrapCommandInShell. No active exploitation has been confirmed (no CISA KEV listing), but a public GitHub security advisory and a fix-bearing release (3000.17.0) are available.
Technical ContextAI
OliveTin is a Go-based self-hosted web application that exposes administrator-defined shell commands to web users. Actions are configured in YAML and can be specified either as shell: strings (executed via sh -c) or as exec: lists (passed directly as arguments, avoiding shell interpolation). The vulnerable code path in service/internal/executor/arguments.go maintained a static map of unsafe argument types (url, email, raw_string_multiline, very_dangerous_raw_string, password) for Shell-mode safety checks but excluded regex: prefixed custom types. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause class: user-controlled input that passed typeSafetyCheckRegex - which only verified pattern matching, not shell-safety - was concatenated into a shell command string without escaping metacharacters. The commit diff (995ff79736f2bccc364448a3ece84087b550b232) confirms the fix: regex: types are now unconditionally classified as unsafe for Shell mode via the new isUnsafeShellArgumentType function, and the anchorCustomRegexPattern helper closes a secondary gap where unanchored patterns (e.g., regex:[a-zA-Z0-9.-]+) could match a value like example.com; id because the regex matched the prefix but not the injected suffix.
RemediationAI
Upgrade to OliveTin 3000.17.0, available at https://github.com/OliveTin/OliveTin/releases/tag/3000.17.0, which resolves the issue by classifying all regex: argument types as unsafe for Shell-mode actions. As an immediate workaround where upgrade is not feasible, convert any Shell-mode actions that use regex: argument types from the shell: string syntax to the exec: list syntax in config.yaml - this bypasses shell interpolation entirely, as exec: passes arguments directly to the process without invoking sh -c; the commit at https://github.com/OliveTin/OliveTin/commit/995ff79736f2bccc364448a3ece84087b550b232 demonstrates this conversion pattern. A secondary compensating control is to audit all OliveTin action configurations and remove or restrict access to any Shell-mode action that uses regex: argument types until the upgrade is applied. Note that simply tightening the regex pattern does not mitigate the vulnerability if the pattern is unanchored, as the fix also adds mandatory anchoring (^ and $) that was absent before 3000.17.0.
OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat
OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut
OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a
OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t
Concurrent action execution in OliveTin versions 3000.0.0 and prior triggers a race condition in a shared text/template.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today