Detections
Analytics

SCA: security update for github.com/OliveTin/OliveTin (GHSA-prj9-97mp-mwh2)

medium Tenable Cloud Security Plugin ID 443882

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OliveTin gives access to predefined shell commands from a web interface. The
 `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not
 explicitly defined in the action's configuration. However, prior to commit
 ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_`
 to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are
 injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through
 unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the
 action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as
 environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed
 command; and included in the template context — available as `.Arguments.ot_*` in template rendering.
 Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch. (CVE-2026-53541)

Solution

Update the github.com/OliveTin/OliveTin library and its related packages to version 0.0.0-20260531214440-ebffd9f040f7 or later.

See Also

https://github.com/advisories/GHSA-prj9-97mp-mwh2

Plugin Details

Severity: Medium

ID: 443882

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/24/2026

Updated: 8/24/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2026-53541

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/24/2026

Vulnerability Publication Date: 6/24/2026

Reference Information

CVE: CVE-2026-53541

cwe: CWE-20