PT-2026-34824 · Th30D4Y+2 · Openlearn

Krrazee · CVE-2026-41900 · Published 2026-04-23 · Updated 2026-05-09

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenLearnX versions prior to 2.0.3

Description OpenLearnX is an open-source, decentralized learning and assessment platform. A remote code execution (RCE) issue exists in the code execution environment, which allows an attacker to escape the Python sandbox and execute arbitrary commands.

Recommendations Update to version 2.0.3.

Exploit

Fix

RCE

OS Command Injection

Code Injection

Protection Mechanism Failure

Improper Access Control

Weakness Enumeration

CWE-250

CWE-78

CWE-94

CWE-693

CWE-284

Related Identifiers

CVE-2026-41900

GHSA-8H25-Q488-4HXW

Affected Products

Openlearn

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41900.json · Exploit
• https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw · Vendor Advisory
• https://github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e · Patch
• https://osv.dev/vulnerability/CVE-2026-41900 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8h25-q488-4hxw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41900 · Security Note
• https://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix · Note
• https://github.com/th30d4y/OpenLearnX · Note
• https://twitter.com/CVEarity/status/2052789919240900857 · Twitter Post
• https://twitter.com/CVEnew/status/2053174716559491441 · Twitter Post
• https://t.me/cveNotify/162739 · Telegram Post
• https://t.me/cveNotify/162665 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1sug4za/resumen_diario_de_vulnerabilidades_24042026 · Reddit Post
• https://t.me/CVEtracker/53066 · Telegram Post
• https://twitter.com/NewsNerdie/status/2052811370630902006 · Twitter Post