CVE-2025-50946 OliveTin OS Command Injection vulnerability

What is CVE-2025-50946?

CVE-2025-50946 is a medium-severity command injection vulnerability in n/a, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

Weakness: CWE-78

Which versions are affected by CVE-2025-50946?

3 open source packages ship an affected version, including github.com/OliveTin/OliveTin. It affects 1 product.

Products include Olivetin Olivetin.

How do I fix CVE-2025-50946?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-50946 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-50946 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2026-27626 OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks Critical 10.0
• CVE-2026-30223 OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes High 8.8
• CVE-2026-31817 OliveTin's unsafe parsing of UniqueTrackingId can be used to write files High 8.5
• CVE-2026-28342 OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint High 7.5
• CVE-2026-28789 OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p3qf-84rg-jxfc, GO-2025-3886.