CVE-2026-48708: OliveTin race condition in template engine causing command contamination

Executive brief

OliveTin, a tool for providing a web interface to shell commands, contains a flaw in how it processes concurrent requests. When multiple users or automated systems trigger actions at the same time, the software may mix up their inputs or crash entirely. This could lead to the wrong commands being executed with unintended arguments, potentially causing data loss or unauthorized system changes.

Technical details

OliveTin uses a single shared 'text/template.Template' instance across all goroutines without proper synchronization. When concurrent 'ExecRequest' calls occur, one goroutine's 'Parse' operation can overwrite the template tree while another goroutine is executing it. This root cause (CWE-362) allows an attacker to potentially inject arguments from one request into the shell command template of another. Additionally, concurrent writes to the internal template maps trigger unrecoverable Go runtime fatals, leading to a Denial of Service. The vulnerability is present in 'service/internal/tpl/templates.go'.

Affected products

• OliveTin OliveTin All versions prior to 2026-05-21 patch

Timeline

• 2026-05-21: patched: Patch committed to repository
• 2026-06-24: advisory: GHSA-7fq5-7wr8-rjwj published

References

• https://api.github.com/users/knight-yagami
• https://github.com/knight-yagami
• https://api.github.com/users/knight-yagami/gists%7B/gist_id%7D
• https://api.github.com/users/knight-yagami/repos
• https://avatars.githubusercontent.com/u/53488798?v=4
• https://api.github.com/users/knight-yagami/events%7B/privacy%7D