7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48708

CVE-2026-48708: OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each ExecRequest spawns a goroutine), a race condition occurs: one goroutine's Parse overwrites the template tree while another goroutine is calling Execute, causing cross-user command contamination, Go runtime panic, and incorrect command execution. This issue has been resolved in version 3000.13.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48708

CVE-2026-48708:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260521225117-d74da9314005-	0.0.0-20260521225117-d74da9314005

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition (CWE-362) in OliveTin's template rendering process. The root cause is the use of a single, shared text/template.Template instance (tpl) across multiple goroutines without proper synchronization. The function parseTemplate in service/internal/tpl/templates.go directly calls tpl.Parse(source), which modifies the shared template object. The ExecRequest function in service/internal/executor/executor.go processes each action in a new goroutine, creating the concurrent environment where the race condition can be triggered. When two or more actions are executed simultaneously, one goroutine can parse a new template, overwriting the template that another goroutine is in the middle of executing. This can lead to cross-request command contamination, where arguments from one user's request are rendered in another user's command template, or a fatal process crash due to concurrent map writes within the Go text/template library. The patch addresses this by cloning the master template (tpl.Clone()) within parseTemplate before parsing, ensuring each goroutine operates on a separate, thread-safe copy.

Vulnerable functions

parseTemplate

service/internal/tpl/templates.go

The function `parseTemplate` uses a single shared `text/template.Template` instance (`tpl`) across all goroutines without any synchronization. It calls `tpl.Parse(source)` on this shared instance. When multiple requests are processed concurrently, a race condition occurs where one goroutine can overwrite the parsed template of another, leading to command contamination or a process crash.

Executor.ExecRequest

service/internal/executor/executor.go

This function spawns a new goroutine for each incoming execution request. This concurrent execution model is what triggers the race condition in the `parseTemplate` function, which unsafely modifies a shared template object. While not containing the vulnerable code itself, `ExecRequest` is the entry point for the concurrency pattern that leads to the exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.