{"id":"CVE-2026-53541","revision":"cbf5ea18bbaa4eac9808e60b8106535f","records":[{"revision":"cbf5ea18bbaa4eac9808e60b8106535f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53541","aliases":[],"title":"OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering","description":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.","state":0,"publishedAt":"2026-08-21T22:51:52.752+00:00","modifiedAt":"2026-08-24T20:03:47.277+00:00","affected":[{"ecosystem":"Vendor product","name":"OliveTin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"OliveTin\",\n                    \"product\": \"OliveTin\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 2025.03.07\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2","https://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53541","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53541","identifiers":["CVE-2026-53541"]},"retained":false,"historicalAffected":[]}],"coverage":[]}