OliveTin exposes predefined shell commands through a web interface. In versions up to 3000.10.0, the safety check that blocks unsafe argument types fails to protect arguments of type `password`. An attacker can supply a `password` argument that contains shell metacharacters, leading to arbitrary OS command execution. The vulnerability also allows a second independent vector via webhook‑extracted JSON values that bypass type safety checks before being passed to the shell. Together, these vectors enable Remote Code Execution with the privileges of the OliveTin process. The known weakness is CWE‑78.

OliveTin versions up to and including 3000.10.0 are affected. No patched version is available at the time of publication, and the application is commonly deployed as a local service with default authentication settings that can allow users to submit webhook calls or shell commands.

The vulnerability carries a CVSS score of 10.0 and an EPSS score of less than 1 %, indicating low current exploitation likelihood but very high impact if exploited. Since the issue is not listed in CISA’s KEV catalog, there is no known widespread active exploitation. An attacker could trigger the vulnerability remotely over HTTP, either by sending a crafted shell command request or by posting a webhook payload. Authenticated users (or all users when authentication is disabled) can perform the attack, and unauthenticated users can succeed if the instance accepts external webhooks. The high severity and ability to achieve full RCE warrant immediate mitigation.