Executive brief
OliveTin, a tool for providing a web interface to shell commands, contains a flaw where certain user-provided arguments can bypass security filters. An attacker with access to trigger actions can inject unvalidated data into the system's environment variables. This could lead to unexpected behavior in scripts or secondary security issues depending on how those scripts use the injected data.
Technical details
The 'filterToDefinedArgumentsOnly' function in 'service/internal/executor/executor.go' contains a logic error that exempts any argument starting with the 'ot_' prefix from validation. While intended for internal system arguments like 'ot_executionTrackingId', this bypass allows remote authenticated users to pass arbitrary 'ot_'-prefixed keys with unvalidated values. These values are subsequently processed by 'buildEnv()', which converts them into uppercase environment variables (e.g., OT_EXAMPLE) and passes them to the executed shell command. Because these values can contain shell metacharacters or newlines, they pose a risk of environment variable pollution and potential secondary exploitation in downstream scripts. A patch is available in version 0.0.0-20260531214440-ebffd9f040f7.
Affected products
- OliveTin OliveTin < 0.0.0-20260531214440-ebffd9f040f7
Timeline
- 2026-05-31: patched: Fix committed to main branch
- 2026-06-24: advisory: GitHub Advisory published