# CVE-2026-48708: OliveTin race condition in template engine causing command contamination

Source: https://junglewise.ai/threats/cve-2026-48708-olivetin-race-condition-in-template-engine-causing-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-48708 · Severity: high · CVSS 7.5 · Published 2026-06-15

OliveTin, a tool for providing a web interface to shell commands, contains a flaw in how it processes concurrent requests. When multiple users or automated systems trigger actions at the same time, the software may mix up their inputs or crash entirely. This could lead to the wrong commands being executed with unintended arguments, potentially causing data loss or unauthorized system changes.

Technologies: [github.com/OliveTin/OliveTin (Go)](https://junglewise.ai/threats/technologies/github-com-olivetin-olivetin), [OliveTin](https://junglewise.ai/threats/technologies/olivetin). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OliveTin](https://junglewise.ai/threats/vendors/olivetin).

## Quick answers

**Is CVE-2026-48708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48708 being exploited in the wild.

**How severe is CVE-2026-48708?** High severity, with a CVSS score of 7.5, published 15 June 2026.

**Which products and versions are affected?** github.com/OliveTin/OliveTin (Go) < 0.0.0-20260521225117-d74da9314005-, SEMVER:introduced=0,fixed=0.0.0-20260521225117-d74da9314005; OliveTin 3000.0.0 and prior, All versions prior to 2026-05-21 patch.

**Is there a fix for CVE-2026-48708?** Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521225117-d74da9314005 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48708 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48708?** Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521225117-d74da9314005 or later

  ```sh
  go get github.com/OliveTin/OliveTin@v0.0.0-20260521225117-d74da9314005
  ```


## Technical details

OliveTin uses a single shared 'text/template.Template' instance across all goroutines without proper synchronization. When concurrent 'ExecRequest' calls occur, one goroutine's 'Parse' operation can overwrite the template tree while another goroutine is executing it. This root cause (CWE-362) allows an attacker to potentially inject arguments from one request into the shell command template of another. Additionally, concurrent writes to the internal template maps trigger unrecoverable Go runtime fatals, leading to a Denial of Service. The vulnerability is present in 'service/internal/tpl/templates.go'.

## Affected products

- OliveTin OliveTin All versions prior to 2026-05-21 patch

## Identifiers

- CVE-2026-48708
- GHSA-7fq5-7wr8-rjwj
- GO-2026-5216

## Timeline

- 2026-05-21: patched: Patch committed to repository
- 2026-06-24: advisory: GHSA-7fq5-7wr8-rjwj published

## References

- [https://api.github.com/users/knight-yagami](https://api.github.com/users/knight-yagami)
- [https://github.com/knight-yagami](https://github.com/knight-yagami)
- [https://api.github.com/users/knight-yagami/gists%7B/gist_id%7D](https://api.github.com/users/knight-yagami/gists%7B/gist_id%7D)
- [https://api.github.com/users/knight-yagami/repos](https://api.github.com/users/knight-yagami/repos)
- [https://avatars.githubusercontent.com/u/53488798?v=4](https://avatars.githubusercontent.com/u/53488798?v=4)
- [https://api.github.com/users/knight-yagami/events%7B/privacy%7D](https://api.github.com/users/knight-yagami/events%7B/privacy%7D)

## Related threats

- [OliveTin input filtering bypass via ot_ prefixed arguments](https://junglewise.ai/threats/cve-2026-53541-olivetin-input-filtering-bypass-via-ot-prefixed-arguments)
- [OliveTin incorrect authorization in synchronous execution endpoints](https://junglewise.ai/threats/cve-2026-67439-olivetin-incorrect-authorization-in-synchronous-execution)
- [OliveTin OS command injection in regex argument validation](https://junglewise.ai/threats/cve-2026-67438-olivetin-os-command-injection-in-regex-argument-validation)
- [OliveTin memory exhaustion via unbounded OAuth2 state map growth](https://junglewise.ai/threats/cve-2026-67437-olivetin-memory-exhaustion-via-unbounded-oauth2-state-map-growth)
- [OliveTin missing authorization in ValidateArgumentType API](https://junglewise.ai/threats/cve-2026-48709-olivetin-missing-authorization-in-validateargumenttype-api)