Is CVE-2026-53541 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53541 being exploited in the wild.

How severe is CVE-2026-53541?

Medium severity, with a CVSS score of 4.3, published 21 August 2026.

Which products and versions are affected?

github.com/OliveTin/OliveTin (Go) < 0.0.0-20260531214440-ebffd9f040f7, SEMVER:introduced=0,fixed=0.0.0-20260531214440-ebffd9f040f7; OliveTin < 0.0.0-20260531214440-ebffd9f040f7.

Is there a fix for CVE-2026-53541?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260531214440-ebffd9f040f7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53541 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53541?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53541: OliveTin input filtering bypass via ot_ prefixed arguments

Q: Is there a fix for CVE-2026-53541?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260531214440-ebffd9f040f7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53541 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-53541?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53541 · Severity: medium · CVSS 4.3 · Published 2026-08-21

OliveTin, a tool for providing a web interface to shell commands, contains a flaw where certain user-provided arguments can bypass security filters. An attacker with access to trigger actions can inject unvalidated data into the system's environment variables. This could lead to unexpected behavior in scripts or secondary security issues depending on how those scripts use the injected data.

Technologies: github.com/OliveTin/OliveTin (Go), OliveTin. Vendors: Go, OliveTin.

Quick answers

Is CVE-2026-53541 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53541 being exploited in the wild.
How severe is CVE-2026-53541?: Medium severity, with a CVSS score of 4.3, published 21 August 2026.
Which products and versions are affected?: github.com/OliveTin/OliveTin (Go) < 0.0.0-20260531214440-ebffd9f040f7, SEMVER:introduced=0,fixed=0.0.0-20260531214440-ebffd9f040f7; OliveTin < 0.0.0-20260531214440-ebffd9f040f7.
Is there a fix for CVE-2026-53541?: Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260531214440-ebffd9f040f7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53541 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53541?: Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260531214440-ebffd9f040f7 or later
```
go get github.com/OliveTin/OliveTin@v0.0.0-20260531214440-ebffd9f040f7
```

Technical details

The 'filterToDefinedArgumentsOnly' function in 'service/internal/executor/executor.go' contains a logic error that exempts any argument starting with the 'ot_' prefix from validation. While intended for internal system arguments like 'ot_executionTrackingId', this bypass allows remote authenticated users to pass arbitrary 'ot_'-prefixed keys with unvalidated values. These values are subsequently processed by 'buildEnv()', which converts them into uppercase environment variables (e.g., OT_EXAMPLE) and passes them to the executed shell command. Because these values can contain shell metacharacters or newlines, they pose a risk of environment variable pollution and potential secondary exploitation in downstream scripts. A patch is available in version 0.0.0-20260531214440-ebffd9f040f7.

Affected products

OliveTin OliveTin < 0.0.0-20260531214440-ebffd9f040f7

Identifiers

CVE-2026-53541
GHSA-prj9-97mp-mwh2
GO-2026-5552

Timeline

2026-05-31: patched: Fix committed to main branch
2026-06-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.