{"id":"CVE-2026-53541","revision":"adbc6c182dc945e6ba480c67c0cafb16","records":[{"revision":"adbc6c182dc945e6ba480c67c0cafb16","observedAt":"2026-10-25T13:17:16.273+00:00","statement":{"source":"nvd","id":"CVE-2026-53541","aliases":[],"title":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior t…","description":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.","state":0,"publishedAt":"2026-08-21T23:16:26.5+00:00","modifiedAt":"2026-10-14T19:10:00.297+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d","https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53541","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20"],"productCriteria":[],"sourceDates":{"published":"2026-08-21T23:16:26.500","lastModified":"2026-10-14T19:10:00.297"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-53541","identifiers":["CVE-2026-53541"]},"retained":false,"historicalAffected":[]}],"coverage":[]}