Executive brief
OpenLearnX is an open-source platform used for decentralized learning and student assessments. A security flaw in its code execution environment allows users to bypass safety restrictions and run unauthorized commands on the underlying server. This could lead to a complete system takeover, data theft, or disruption of the learning platform.
Technical details
A remote code execution (RCE) vulnerability exists in the OpenLearnX code execution environment due to improper neutralization of special elements and protection mechanism failure. The flaw allows an attacker with low privileges to escape the Python sandbox and execute arbitrary OS commands on the host system. The vulnerability is rooted in improper control of code generation (CWE-94) and command injection (CWE-78) within the compiler/coding execution component. This issue is reachable over the network without user interaction. A fix has been released in version 2.0.3 which hardens the execution sandbox.
Affected products
- th30d4y OpenLearnX Prior to 2.0.3
Timeline
- 2026-04-17: patched: Initial security fix commit and release tag v2.0.3-security-fix created.
- 2026-05-08: disclosed: CVE-2026-41900 published.
- 2026-05-08: advisory: GitHub Security Advisory GHSA-8h25-q488-4hxw published.