CVE-2026-27626 OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

What is CVE-2026-27626?

CVE-2026-27626 is a critical command injection vulnerability in OliveTin, published on 25 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user supplying a `password`-typed argument can inject shell metacharacters that execute arbitrary OS commands. A second independent vector allows unauthenticated RCE via webhook-extracted JSON values that skip type safety checks entirely before reaching `sh -c`. When exploiting vector 1, any authenticated user (registration enabled by default, `authType: none` by default) can execute arbitrary OS commands on the OliveTin host with the permissions of the OliveTin process. When exploiting vector 2, an unauthenticated attacker can achieve the same if the instance receives webhooks from external sources, which is a primary OliveTin use case. When an attacker exploits both vectors, this results in unauthenticated RCE on any OliveTin instance using Shell mode with webhook-triggered actions. As of time of publication, a patched version is not available.

Weakness: CWE-78

Which versions are affected by CVE-2026-27626?

3 open source packages ship an affected version, including github.com/OliveTin/OliveTin. It affects 1 product.

Products include Olivetin Olivetin.

How do I fix CVE-2026-27626?

Upgrade github.com/OliveTin/OliveTin to 0.0.0-20260222101908-4bbd2eab1532 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-27626 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27626 exists.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in OliveTin

• CVE-2026-30223 OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes High 8.8
• CVE-2026-31817 OliveTin's unsafe parsing of UniqueTrackingId can be used to write files High 8.5
• CVE-2026-28342 OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint High 7.5
• CVE-2026-28789 OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling High 7.5
• CVE-2026-28790 OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-49gm-hh7w-wfvf, GO-2026-4547.