OliveTin is a web‑based interface that lets users trigger predefined shell commands. Between versions 3000.2.0 and 3000.17.0 the checkShellArgumentSafety function did not treat regex: custom argument types as unsafe for Shell mode actions. Consequently, an attacker can supply a value that satisfies typeSafetyCheckRegex, which is then interpolated by wrapCommandInShell into an sh -c command string, leading to arbitrary OS command execution. The weakness is catalogued as CWE‑78 (OS Command Injection).

The vulnerability affects OliveTin releases from 3000.2.0 up to and including 3000.16.999. Updating to OliveTin version 3000.17.0 or newer removes the flaw, as the checkShellArgumentSafety function now prevents regex: custom types from being treated as safe.

The CVSS score of 6.6 indicates a medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web interface; an attacker could inject payloads through the custom regex argument of a Shell mode action. If exploited, the attacker gains OS command execution on the host, which could compromise confidentiality, integrity, and availability of the system.