Is CVE-2026-48708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48708 being exploited in the wild.

How severe is CVE-2026-48708?

High severity, with a CVSS score of 7.5, published 15 June 2026.

Which products and versions are affected?

github.com/OliveTin/OliveTin (Go) < 0.0.0-20260521225117-d74da9314005-, SEMVER:introduced=0,fixed=0.0.0-20260521225117-d74da9314005; OliveTin 3000.0.0 and prior, All versions prior to 2026-05-21 patch.

Is there a fix for CVE-2026-48708?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521225117-d74da9314005 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48708 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48708?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48708: OliveTin race condition in template engine causing command contamination

Q: Is there a fix for CVE-2026-48708?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521225117-d74da9314005 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48708 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-48708?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48708 · Severity: high · CVSS 7.5 · Published 2026-06-15

OliveTin, a tool for providing a web interface to shell commands, contains a flaw in how it processes concurrent requests. When multiple users or automated systems trigger actions at the same time, the software may mix up their inputs or crash entirely. This could lead to the wrong commands being executed with unintended arguments, potentially causing data loss or unauthorized system changes.

Technologies: github.com/OliveTin/OliveTin (Go), OliveTin. Vendors: Go, OliveTin.

Quick answers

Is CVE-2026-48708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48708 being exploited in the wild.
How severe is CVE-2026-48708?: High severity, with a CVSS score of 7.5, published 15 June 2026.
Which products and versions are affected?: github.com/OliveTin/OliveTin (Go) < 0.0.0-20260521225117-d74da9314005-, SEMVER:introduced=0,fixed=0.0.0-20260521225117-d74da9314005; OliveTin 3000.0.0 and prior, All versions prior to 2026-05-21 patch.
Is there a fix for CVE-2026-48708?: Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521225117-d74da9314005 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48708 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48708?: Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521225117-d74da9314005 or later
```
go get github.com/OliveTin/OliveTin@v0.0.0-20260521225117-d74da9314005
```

Technical details

OliveTin uses a single shared 'text/template.Template' instance across all goroutines without proper synchronization. When concurrent 'ExecRequest' calls occur, one goroutine's 'Parse' operation can overwrite the template tree while another goroutine is executing it. This root cause (CWE-362) allows an attacker to potentially inject arguments from one request into the shell command template of another. Additionally, concurrent writes to the internal template maps trigger unrecoverable Go runtime fatals, leading to a Denial of Service. The vulnerability is present in 'service/internal/tpl/templates.go'.

Affected products

OliveTin OliveTin All versions prior to 2026-05-21 patch

Identifiers

CVE-2026-48708
GHSA-7fq5-7wr8-rjwj
GO-2026-5216

Timeline

2026-05-21: patched: Patch committed to repository
2026-06-24: advisory: GHSA-7fq5-7wr8-rjwj published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.