DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67438: CVE-2026-67438: OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in OliveTin

#security #cve #cybersecurity

CVE-2026-67438: OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in OliveTin

Vulnerability ID: CVE-2026-67438
CVSS Score: 6.6
Published: 2026-07-30

An OS command injection vulnerability exists in OliveTin versions >= 3000.2.0 and < 3000.17.0. The flaw stems from a validation bypass in the shell safety engine, which fails to recognize custom regular expression arguments as unsafe for actions run in shell execution mode. Furthermore, because these custom regex checks evaluate partial string matches, attackers can append arbitrary shell metacharacters to valid inputs. This allows unauthenticated or low-privilege users who are authorized to run configured actions to inject shell commands and achieve arbitrary remote code execution on the host system.

TL;DR

OliveTin versions before 3000.17.0 are vulnerable to OS command injection because the shell argument validator excludes 'regex:' argument types from its safety blocklist. Concurrently, unanchored regex validations allow attackers to bypass checks by placing a valid match at the beginning of their input followed by malicious shell commands.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-78 (OS Command Injection)
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.6 (Medium)
  • EPSS Score: 0.00995
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • OliveTin (Server Deployments)
  • OliveTin Docker Containers
  • OliveTin Systemd Services
  • OliveTin: >= 3000.2.0, < 3000.17.0 (Fixed in: 3000.17.0)

Code Analysis

Commit: 995ff79

Fix command injection via custom regex and add anchor validation patterns.

Mitigation Strategies

  • Upgrade OliveTin to version 3000.17.0 or later to apply the validation enforcement fixes.
  • Convert existing shell-mode actions to exec-mode actions inside config.yaml to eliminate the shell parsing vector.
  • Ensure all custom regular expressions are strictly bounded with start and end anchors (^ and $) if used in other validated contexts.

Remediation Steps:

  1. Review the current OliveTin configuration files (config.yaml) for combinations of 'shell:' and 'type: regex:'.
  2. Replace 'shell:' keys with structured 'exec:' arrays to ensure arguments are handled through secure processes.
  3. Update Docker compose files, Helm charts, or system service binaries to pull OliveTin image/binary version 3000.17.0 or greater.
  4. Restart the OliveTin service and verify configuration logs to ensure no initialization errors occur during loading.

References

Read the full report for CVE-2026-67438 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)