PT-2026-52182 · Go · Github.Com/Olivetin/Olivetin

Published

2026-06-24

·

Updated

2026-06-24

·

CVE-2026-53541

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, a special case allows any argument whose name starts with ot to bypass this filter. While two system arguments (ot executionTrackingId and ot username) are injected by OliveTin and overridden, all other ot -prefixed arguments supplied by the user pass through unmodified.
These bypassed arguments are:
  1. Not type-checked — the validation loop only iterates over the action's defined arguments, so ot -prefixed arguments skip all type safety checks entirely.
  2. Set as environment variables — via buildEnv(), with completely unvalidated values, and passed to the executed command.
  3. Included in the template context — available as .Arguments.ot * in template rendering.

Affected Code

Filter bypass — service/internal/executor/executor.go (lines 728–731):
go
func keepArgument(name string, definedNames map[string]struct{}) bool {
   , ok := definedNames[name]
  return ok || strings.HasPrefix(name, "ot ")
}
System args only override two keys — service/internal/executor/executor.go (lines 742–745):
go
func injectSystemArgs(req *ExecutionRequest) {
  req.Arguments["ot executionTrackingId"] = req.TrackingID
  req.Arguments["ot username"] = req.AuthenticatedUser.Username
}
Any other ot -prefixed argument (e.g., ot malicious) survives both functions.
Unvalidated values become environment variables — service/internal/executor/executor.go (lines 867–882):
go
func buildEnv(args map[string]string) []string {
  ret := append(os.Environ(), "OLIVETIN=1")
  for k, v := range args {
    varName := fmt.Sprintf("%v", strings.TrimSpace(strings.ToUpper(k)))
    if varName == "" { continue }
    ret = append(ret, fmt.Sprintf("%v=%v", varName, v))
  }
  return ret
}
The value v is never validated. It can contain newlines, shell metacharacters, null bytes, or any arbitrary data.

Proof of Concept

An attacker sends a StartAction request with extra ot -prefixed arguments:
json
{
 "bindingId": "<any-action-id>",
 "arguments": [
  { "name": "ot custom var", "value": "arbitrary unvalidated content 
 with newlines" },
  { "name": "ot another",  "value": "$(whoami)" }
 ]
}
These arguments:
  • Pass through filterToDefinedArgumentsOnly (the ot prefix exempts them).
  • Are never type-checked (not in the action's argument definitions).
  • Become environment variables OT CUSTOM VAR and OT ANOTHER in the executed command's environment.
  • Are available in the template rendering context as .Arguments.ot custom var and .Arguments.ot another.

Impact

  • Environment variable pollution — attacker can set arbitrary environment variables (with OT uppercased prefix) in the execution environment of any action they can trigger. Scripts or programs that read custom environment variables could be influenced.
  • Potential for secondary exploitation — if any executed script or command reads OT -prefixed environment variables, the unvalidated content could cause unexpected behavior.
  • Template context pollution — although Go's text/template does not recursively evaluate data values (mitigating direct template injection), the extra arguments are accessible in the template context and could interact unexpectedly with custom template logic.

Suggested Fix

Remove the ot prefix exception from keepArgument, or restrict it to only the two known system arguments:
go
var systemArgs = map[string]struct{}{
  "ot executionTrackingId": {},
  "ot username":      {},
}

func keepArgument(name string, definedNames map[string]struct{}) bool {
   , isDefined := definedNames[name]
   , isSystem := systemArgs[name]
  return isDefined || isSystem
}

Discovery Methodology

Both vulnerabilities were identified through manual source code review of the OliveTin repository, focusing on:
  • Input validation boundaries (API request fields flowing into file system operations and execution contexts)
  • Argument filtering and type-checking logic in the executor
  • File path construction in the log persistence feature
No automated scanners or fuzzing tools were used. The review was conducted against the current main branch source code.

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-53541
GHSA-PRJ9-97MP-MWH2

Affected Products

Github.Com/Olivetin/Olivetin