CVE-2026-53541

Name of the Vulnerable Software and Affected Versions OliveTin (affected versions not specified)

Description The filterToDefinedArgumentsOnly function in the executor fails to properly restrict arguments, allowing any argument starting with the ot prefix to bypass input filtering. While the system is designed to inject ot executionTrackingId and ot username, any other user-supplied arguments with the ot prefix are not type-checked and are passed unmodified. These arguments are subsequently processed by the buildEnv() function and set as environment variables in the execution environment of the triggered action. This can lead to environment variable pollution, where an attacker can set arbitrary variables that may influence the behavior of executed scripts or programs. Additionally, these arguments are included in the template rendering context as .Arguments.ot *, which could interact unexpectedly with custom template logic.

Recommendations As a temporary workaround, restrict the use of any custom arguments starting with the ot prefix in action requests. Remove the ot prefix exception from the keepArgument() function or restrict it exclusively to the ot executionTrackingId and ot username system arguments.