8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41900

CVE-2026-41900: OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

Overview

A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41900

CVE-2026-41900:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openlearnx	npm	< 2.0.3	2.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability was a critical Remote Code Execution (RCE) due to a failure to properly sandbox user-submitted code. The analysis of the patch reveals that the application had multiple code execution endpoints. The most evident vulnerability was in backend/routes/compiler.py, where the execute_python function would write arbitrary code from a user to a file and then execute it using subprocess.run. This provides a direct and unrestricted way to execute commands on the host system. Another endpoint in backend/routes/coding.py also used an insecure method for code execution. The vulnerability was not just a simple command injection but a fundamental flaw in the sandboxing mechanism for the code execution environment.

The fix involved a major refactoring of the code execution logic. The vulnerable functions that used subprocess.run directly were removed. A new centralized service, RealCompilerService, was introduced (and hardened) to handle all code execution requests. This new service uses Docker containers to create a strongly isolated sandbox for each execution, with defined timeouts, memory limits, and CPU limits. This ensures that any user-submitted code, even if malicious, is contained within the Docker environment and cannot affect the host system, effectively mitigating the RCE vulnerability.

Vulnerable functions

compiler.execute_code

backend/routes/compiler.py

This function was the main API endpoint for the code compiler. It took user-provided code and language as input and passed it to insecure execution functions like `execute_python`. An attacker could send malicious Python code to this endpoint to achieve remote code execution.

compiler.execute_python

backend/routes/compiler.py

This function is directly responsible for the remote code execution vulnerability. It writes the user's code to a temporary file and then executes it using `subprocess.run` with `python3`. There are no sandbox restrictions, allowing an attacker to execute arbitrary commands on the server by crafting malicious Python code that breaks out of the intended script's logic (e.g., by importing `os` and running shell commands).

coding.execute_code

backend/routes/coding.py

This function is another entry point for code execution, specifically for the coding practice feature. It previously used a function called `execute_in_container` which was also vulnerable to sandbox escape. The patch replaced this call with the new secure `real_compiler_service`, indicating the original implementation was flawed and part of the attack surface.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.