PT-2026-34824 · Th30D4Y+1 · Openlearn

Krrazee · Published 2026-04-23 · Updated 2026-05-09 · CVE-2026-41900

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenLearnX versions prior to 2.0.3

Description OpenLearnX is an open-source, decentralized learning and assessment platform. A remote code execution (RCE) issue exists in the code execution environment, which allows an attacker to escape the Python sandbox and execute arbitrary commands.

Recommendations Update to version 2.0.3.

Fix

RCE

Improper Access Control

Protection Mechanism Failure

Code Injection

OS Command Injection

Weakness Enumeration

CWE-250

CWE-284

CWE-693

CWE-94

CWE-78

Related Identifiers

CVE-2026-41900

GHSA-8H25-Q488-4HXW

Affected Products

Openlearn

References · 14

• https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw · Vendor Advisory
• https://github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41900 · Security Note
• https://osv.dev/vulnerability/GHSA-8h25-q488-4hxw · Vendor Advisory
• https://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix · Note
• https://github.com/th30d4y/OpenLearnX · Note
• https://t.me/cveNotify/162739 · Telegram Post
• https://twitter.com/NewsNerdie/status/2052811370630902006 · Twitter Post
• https://twitter.com/CVEarity/status/2052789919240900857 · Twitter Post
• https://t.me/cveNotify/162665 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1sug4za/resumen_diario_de_vulnerabilidades_24042026 · Reddit Post
• https://t.me/CVEtracker/53066 · Telegram Post
• https://twitter.com/infoflowcloud/status/2053175978432540812 · Twitter Post
• https://twitter.com/CVEnew/status/2053174716559491441 · Twitter Post