{"id":"CVE-2026-53541","sourceIdentifier":"security-advisories@github.com","published":"2026-08-21T23:16:26.500","lastModified":"2026-10-14T19:10:00.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch."},{"lang":"es","value":"OliveTin da acceso a comandos de shell predefinidos desde una interfaz web. La función 'filterToDefinedArgumentsOnly' en el ejecutor está destinada a descartar cualquier argumento no definido explícitamente en la configuración de la acción. Sin embargo, antes del commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, un caso especial permite que cualquier argumento cuyo nombre comience con 'ot_' eluda este filtro. Si bien dos argumentos del sistema ('ot_executionTrackingId' y 'ot_username') son inyectados por OliveTin y sobrescritos, todos los demás argumentos con prefijo 'ot_' proporcionados por el usuario pasan sin modificar. Estos argumentos eludidos no son verificados por tipo - el bucle de validación solo itera sobre los argumentos definidos de la acción, por lo que los argumentos con prefijo 'ot_' omiten por completo todas las comprobaciones de seguridad de tipo; se establecen como variables de entorno - a través de 'buildEnv()', con valores completamente no validados, y se pasan al comando ejecutado; y se incluyen en el contexto de la plantilla - disponibles como '.Arguments.ot_*' en la renderización de plantillas. El commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contiene un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"OliveTin","product":"OliveTin","versions":[{"version":"<= 2025.03.07","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-24T20:03:40.743318Z","id":"CVE-2026-53541","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d","source":"security-advisories@github.com"},{"url":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2","source":"security-advisories@github.com"},{"url":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}