10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27626

CVE-2026-27626: OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

Summary

OliveTin's shell mode safety check (checkShellArgumentSafety) blocks several dangerous argument types but not password. A user supplying a password-typed argument can inject shell metacharacters that execute arbitrary OS commands. A second independent vector allows unauthenticated RCE via webhook-extracted JSON values that skip type safety checks entirely before reaching sh -c.

Details

Vector 1 — password type bypasses shell safety check (PR:L)

service/internal/executor/arguments.go has two gaps:

// Line 198-199 — TypeSafetyCheck returns nil (no error) for password type
case "password":
    return nil  // accepts ANY string including ; | ` $()

// Line 313 — checkShellArgumentSafety blocks dangerous types but not password
unsafe := map[string]bool{
    "url":                      true,
    "email":                    true,
    "raw_string_multiline":     true,
    "very_dangerous_raw_string": true,
    // "password" is absent — not blocked
}

Shell execution at service/internal/executor/executor_unix.go:18:

exec.CommandContext(ctx, "sh", "-c", finalParsedCommand)

A user supplies a password argument value of '; id; echo ' → sh -c interprets the shell metacharacters → arbitrary command execution.

This is not the "admin already has access" pattern: OliveTin explicitly enforces an admin/user boundary where admins define commands and users only supply argument values. The password type is the documented, intended mechanism for user-supplied sensitive values. The safety check exists precisely to prevent users from escaping this boundary — password is the one type it fails to block.

Vector 2 — Webhook JSON extraction skips TypeSafetyCheck entirely (PR:N)

service/internal/executor/handler.go:153-157 extracts arbitrary key-value pairs from webhook JSON payloads and injects them into . These webhook-extracted arguments have no corresponding config-defined entry, so in finds no type to check against and skips entirely. The values are templated directly into the shell command and passed to .

Miggo Vulnerability Database

→

CVE-2026-27626

CVE-2026-27626:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260222101908-4bbd2eab1532	0.0.0-20260222101908-4bbd2eab1532

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis identified two distinct vectors for OS command injection in OliveTin, as detailed in the vulnerability description. The root cause is insufficient input validation for arguments used to construct shell commands.

Vector 1 (Authenticated RCE):

An argument of type password is submitted by a user.
The executor.TypeSafetyCheck function is called but contains a flaw where it unconditionally approves any string for the password type.
The executor.checkShellArgumentSafety function, which is supposed to be a secondary check, fails to block the password type because it is missing from its list of unsafe types.
The malicious string, containing shell metacharacters, is then embedded into a command template.
Finally, the executor.Execute function runs the crafted command string using sh -c, leading to command injection.

Vector 2 (Unauthenticated RCE):

An unauthenticated attacker sends a malicious JSON payload to a configured webhook endpoint.
The executor.WebhookHandler function processes the request, extracting all key-value pairs from the JSON body and adding them as arguments to the execution request.
These arguments are untyped. When executor.parseActionArguments processes them, it finds no type information and consequently skips calling TypeSafetyCheck.
The unsanitized, malicious values from the webhook are embedded into the command template.
The executor.Execute function runs the resulting command string, leading to unauthenticated remote command execution.

Both vectors converge on the executor.Execute function, which acts as the execution sink. The vulnerable functions identified are all the key components in the data flow that fail to properly sanitize or block the malicious input before it reaches this sink.

Vulnerable functions

executor.Execute

service/internal/executor/executor_unix.go

This function is the final execution sink where the crafted command is run. It receives a command string that has been assembled from a template and user-provided arguments. Due to flaws in argument validation for 'password' types and webhook-derived values, this string can contain malicious shell metacharacters, leading to OS command injection when executed by `sh -c`.

executor.TypeSafetyCheck

service/internal/executor/arguments.go

This function is responsible for validating the safety of an argument based on its type. For arguments of type 'password', the function incorrectly returns `nil` (no error) for any input string. This allows shell metacharacters (e.g., ';', '`', '$()') to pass through the validation process, enabling command injection in downstream functions.

executor.checkShellArgumentSafety

service/internal/executor/arguments.go

This function performs a safety check to prevent arguments of certain types from being used in shell commands. The vulnerability exists because the 'password' argument type is not included in its list of unsafe types. This allows a user-supplied password, which has already passed the flawed `TypeSafetyCheck`, to be incorporated into a shell command without being properly sanitized.

executor.parseActionArguments

service/internal/executor/arguments.go

This function is responsible for parsing and validating action arguments. For arguments originating from a webhook's JSON payload, it fails to assign a type. Because there is no type, the function skips calling `TypeSafetyCheck`, allowing potentially malicious, un-sanitized strings from the webhook to be passed on and eventually executed.

executor.WebhookHandler

service/internal/executor/handler.go

This function handles incoming webhooks. It extracts key-value pairs from the JSON body of the webhook request and adds them directly to the execution arguments. These arguments have no defined type and are not subjected to any safety checks, creating a vector for unauthenticated remote command execution when they are used to build a shell command.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27626: OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

Summary

Details

CVE-2026-27626:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2026-27626: OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

Summary

Details

PoC

Impact

Basic Information

Basic Information

10

10

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27626: OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

Summary

Details

CVE-2026-27626:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2026-27626: OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

Summary

Details

PoC

Impact

Basic Information

Basic Information

10

10

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI