{"id":"EUVD-2026-28500","enisaUuid":"f8fe108f-81a0-33e5-9cfa-a0d4fcb713fe","description":"OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.","datePublished":"May 8, 2026, 3:25:50 AM","dateUpdated":"May 8, 2026, 12:54:17 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw\nhttps://github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e\nhttps://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix\n","aliases":"CVE-2026-41900\nGHSA-8h25-q488-4hxw\n","assigner":"GitHub_M","epss":0.91,"enisaIdProduct":[{"id":"67d247e5-fb86-32ae-b56a-f16a79b6076d","product":{"name":"OpenLearnX","vendor":{"name":"th30d4y"}},"product_version":"\u003c 2.0.3"}],"enisaIdVendor":[{"id":"15f77eb6-13c3-3a20-85f4-b4f731fb3fe1","vendor":{"name":"th30d4y"}}],"enisaIdVulnerability":[{"id":"44f50a6f-e9fc-319b-9350-aac8553fd6bd","vulnerability":{"id":"GHSA-8h25-q488-4hxw","description":"OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment","datePublished":"Apr 23, 2026, 9:46:07 PM","dateUpdated":"May 11, 2026, 1:49:47 PM","baseScore":0.0,"references":"https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41900\nhttps://github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e\nhttps://github.com/th30d4y/OpenLearnX\nhttps://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix\n","enisa_id":"EUVD-2026-28500\n","aliases":"CVE-2026-41900\nGHSA-8h25-q488-4hxw\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dadca2a6-290c-3620-a4c3-2b8dbf6bdbe0","vulnerability":{"id":"CVE-2026-41900","description":"OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.","datePublished":"May 8, 2026, 3:25:50 AM","dateUpdated":"May 8, 2026, 12:54:17 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw\nhttps://github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e\nhttps://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix\n","enisa_id":"EUVD-2026-28500\n","assigner":"GitHub_M","epss":0.91,"dataProcessed":"Oct 27, 2026, 7:17:47 AM","vulnerabilityProduct":[{"id":"98db0549-1091-3e77-a1af-08379a6a86bb","product":{"name":"OpenLearnX","vendor":{"name":"th30d4y"}},"product_version":"\u003c 2.0.3"}],"vulnerabilityVendor":[{"id":"c94baf88-56c8-347f-87ff-6d0e4f90cee9","vendor":{"name":"th30d4y"}}]}}],"enisaIdAdvisory":[]}