Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-67438— OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Quick assessment

Affected
OliveTin OliveTin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OliveTin是OliveTin团队开源的一个Web应用。 OliveTin 3000.2.0版本至3000.17.0之前版本存在命令注入漏洞，该漏洞源于checkShellArgumentSafety函数未将regex自定义参数类型视为不安全，导致OS命令注入。

CVSS 6.6 · Medium EPSS 1.59% · P75

Possible ATT&CK Techniques 1 AI

T1059.004 · Unix Shell

Affected Version Matrix 1

VendorProduct Version RangeStatus
OliveTin OliveTin >= 3000.2.0, < 3000.17.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-67438

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check
Source: CVE Program / CVE List V5
Vulnerability Description
OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c command string and enabling OS command injection. This issue is fixed in version 3000.17.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
OliveTin 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OliveTin是OliveTin团队开源的一个Web应用。 OliveTin 3000.2.0版本至3000.17.0之前版本存在命令注入漏洞，该漏洞源于checkShellArgumentSafety函数未将regex自定义参数类型视为不安全，导致OS命令注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
OliveTin OliveTin >= 3000.2.0, < 3000.17.0 -

II. Public POCs for CVE-2026-67438

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-67438

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-67438 (1)

Vendor Advisories for CVE-2026-67438 (1)

Vendor Pages for CVE-2026-67438 (1)

Same Patch Batch · OliveTin · 2026-07-29 · 3 CVEs total

CVE-2026-67437 7.5 HIGH OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
CVE-2026-67439 4.3 MEDIUM OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

IV. Related Vulnerabilities

Same product: OliveTin
Same vendor: OliveTin
Same weakness: CWE-78

V. Comments for CVE-2026-67438

No comments yet

Leave a comment