OliveTin’s executor is supposed to discard arguments not declared in an action. Before a recent patch, any argument prefixed with "ot_" bypassed this filter. Those arguments are neither type‑checked nor sanitized and are written directly to the environment of the executed command via buildEnv(). This allows a user to inject arbitrary values into environment variables that affect command execution or template rendering, creating a source for command‑line injection or template‑based disclosure. The CVSS score of 4.3 labels it a moderate‑severity flaw, indicating that successful exploitation can compromise the integrity and confidentiality of the system running OliveTin.

The flaw exists in OliveTin, impacting all releases that predate the patch commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d. Users running any older version that still contains the special "ot_" bypass code are vulnerable. OvalThe product is OliveTin:OliveTin, and no specific versions are listed in the advisory; therefore, all legacy builds remain affected until the fix is applied.

The vulnerability’s exploitability depends on access to the OliveTin web interface. An attacker who can submit custom action arguments can supply any "ot_" prefixed value. Because the values are passed unsanitized to the executed shell command, the attacker can create or manipulate environment variables that affect both the command itself and subsequent template rendering. This can lead to arbitrary command execution or privilege escalation on the host. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting lower immediate threat, but its moderate CVSS score and lack of filtering make it a target for opportunistic abuse once an OliveTin instance is exposed.