CVE-2026-67438— OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check
Possible ATT&CK Techniques 1AI
T1059.004 · Unix ShellGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-67438
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check
Source: CVE Program / CVE List V5
Vulnerability Description
OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c command string and enabling OS command injection. This issue is fixed in version 3000.17.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
OliveTin 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OliveTin是OliveTin团队开源的一个Web应用。 OliveTin 3000.2.0版本至3000.17.0之前版本存在命令注入漏洞，该漏洞源于checkShellArgumentSafety函数未将regex自定义参数类型视为不安全，导致OS命令注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-67438
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67438
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-67438 (1)
Vendor Advisories for CVE-2026-67438 (1)
Vendor Pages for CVE-2026-67438 (1)
Same Patch Batch · OliveTin · 2026-07-29 · 3 CVEs total
| CVE-2026-67437 | 7.5 HIGH | OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) |
| CVE-2026-67439 | 4.3 MEDIUM | OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output |
IV. Related Vulnerabilities
Same product: OliveTin
- CVE-2026-67439
OliveTin: StartActionAndWait Endpoints Bypass `logs` Permiss - CVE-2026-67437
OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaus - CVE-2026-48709
OliveTin: ValidateArgumentType API Endpoint Missing Authenti - CVE-2026-48708
OliveTin has a Concurrent Template Parsing Race Condition wh - CVE-2026-32102
OliveTin Unauthorized Action Output Disclosure via EventStre
Same vendor: OliveTin
- CVE-2026-67439
OliveTin: StartActionAndWait Endpoints Bypass `logs` Permiss - CVE-2026-67437
OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaus - CVE-2026-48709
OliveTin: ValidateArgumentType API Endpoint Missing Authenti - CVE-2026-48708
OliveTin has a Concurrent Template Parsing Race Condition wh - CVE-2026-32102
OliveTin Unauthorized Action Output Disclosure via EventStre
Same weakness: CWE-78
- CVE-2026-73680
Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpe - CVE-2026-17186
IBM Db2 Mirror for i is affected by multiple vulnerabilities - CVE-2026-17179
IBM Db2 Mirror for i is affected by multiple vulnerabilities - CVE-2026-19188
Haiwell IoT Cloud HMI Gateway OS Command Injection - CVE-2026-19682
Command Injection
V. Comments for CVE-2026-67438
No comments yet