CVE-2026-48708

Name of the Vulnerable Software and Affected Versions OliveTin versions prior to 3000.13.0

Description The template engine utilizes a single shared text/template.Template instance, specifically the tpl package-level variable in service/internal/tpl/templates.go, across all goroutines. Each action execution invokes tpl.Parse(source) followed by t.Execute() on this shared instance without synchronization. When multiple actions execute concurrently, a race condition occurs where one goroutine's Parse operation overwrites the template tree while another is calling Execute. This leads to cross-user command contamination, Go runtime panics, and incorrect command execution.

Recommendations Update to version 3000.13.0.