{"id":"EUVD-2026-64203","revision":"4a519ffa171445409f1b559104229458","records":[{"revision":"4a519ffa171445409f1b559104229458","observedAt":"2026-11-07T11:37:44.864+00:00","statement":{"source":"euvd","id":"EUVD-2026-64203","aliases":["CVE-2026-53541","GHSA-prj9-97mp-mwh2"],"title":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior t…","description":"OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3,"severity":null}],"references":["https://github.com/OliveTin/OliveTin/security/advisories/GHSA-prj9-97mp-mwh2","https://github.com/OliveTin/OliveTin/commit/ebffd9f040f791208aee1db2e5a8aecd1e3e603d"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64203","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 21, 2026, 10:51:52 PM","dateUpdated":"Aug 24, 2026, 8:03:47 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64203","identifiers":["EUVD-2026-64203","CVE-2026-53541","GHSA-prj9-97mp-mwh2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}