Command Injection Vulnerability in OliveTin by OliveTin

CVE-2026-53541

What is CVE-2026-53541?

The OliveTin product has a vulnerability that allows command injection through user-supplied arguments. Specifically, the filtering mechanism in the filterToDefinedArgumentsOnly function is improperly configured, enabling any argument starting with ot_ to bypass validation. This lapse permits these arguments to be processed without type checks, risking the execution of unvalidated commands. While attempts were made to patch this issue in a recent commit, any lingering usage of affected versions remains a security concern.

References