{"id":"EUVD-2026-64203","enisaUuid":"48779b30-351b-34cd-8ab5-ab5cd3824191","description":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action\u0027s configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action\u0027s defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.","datePublished":"Aug 21, 2026, 10:51:52 PM","dateUpdated":"Aug 24, 2026, 8:03:47 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2\nhttps://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d\n","aliases":"CVE-2026-53541\nGHSA-prj9-97mp-mwh2\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"e2ef0967-3ade-3810-b738-b94161bb55fa","product":{"name":"OliveTin","vendor":{"name":"OliveTin"}},"product_version":"≤ 2025.03.07"}],"enisaIdVendor":[{"id":"a51427e6-a10d-325c-a617-181862c044b7","vendor":{"name":"OliveTin"}}],"enisaIdVulnerability":[{"id":"71975fc0-4b00-385f-b3f8-25f8576705f3","vulnerability":{"id":"CVE-2026-53541","description":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action\u0027s configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action\u0027s defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.","datePublished":"Aug 21, 2026, 10:51:52 PM","dateUpdated":"Aug 24, 2026, 8:03:47 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2\nhttps://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d\n","enisa_id":"EUVD-2026-64203\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 9, 2026, 7:16:09 AM","vulnerabilityProduct":[{"id":"786a3451-3dcf-3fdc-b3db-653718962fcf","product":{"name":"OliveTin","vendor":{"name":"OliveTin"}},"product_version":"≤ 2025.03.07"}],"vulnerabilityVendor":[{"id":"56f82eb0-cf63-313a-83c0-28cc1f74eaa1","vendor":{"name":"OliveTin"}}]}},{"id":"ad581358-b8fb-3228-b427-cc79694972df","vulnerability":{"id":"GHSA-prj9-97mp-mwh2","description":"OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering","datePublished":"Jun 24, 2026, 5:43:50 PM","dateUpdated":"Jun 24, 2026, 5:43:50 PM","baseScore":0.0,"references":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2\nhttps://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d\nhttps://github.com/OliveTin/OliveTin\n","enisa_id":"EUVD-2026-64203\n","aliases":"GHSA-prj9-97mp-mwh2\nCVE-2026-53541\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:59:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}