CVE-2026-53541: olivetin Improper Input Validation

Vulnerability summary

CVE-2026-53541 is a medium (CVSS 4.3) Improper Input Validation vulnerability in olivetin. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities.

Timeline

1. 21-08-2026
   PublishedVulnerability first disclosed.
2. 24-08-2026
   Last modifiedVulnerability information updated.

Description

OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.