CVE-2026-41900

🗓️ 08 May 2026 03:25:50Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 64 Views🌐 WEB

OpenLearnX had remote code execution in its code execution environment before version 2.0.3; patched.

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for CVE-2026-41900	6 May 202619:07	–	githubexploit
attackerkb	CVE-2026-41900	8 May 202603:25	–	attackerkb
Circl	CVE-2026-41900	6 May 202623:00	–	circl
CNNVD	OpenLearnX 操作系统命令注入漏洞	8 May 202600:00	–	cnnvd
Cvelist	CVE-2026-41900 OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment	8 May 202603:25	–	cvelist
Github Security Blog	OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment	23 Apr 202621:46	–	github
Kitploit	CVE-2026-41900-POC	8 Oct 202619:24	–	kitploit
Mend	CVE-2026-41900	8 May 202603:25	–	mend
NVD	CVE-2026-41900	8 May 202604:16	–	nvd
OSV	GHSA-8H25-Q488-4HXW OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment	23 Apr 202621:46	–	osv

NVD

Node

th30d4y openlearnxMatch2.0.1node.js

[
  {
    "vendor": "th30d4y",
    "product": "OpenLearnX",
    "versions": [
      {
        "version": "< 2.0.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix
github	www.github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e
github	www.github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw

Parameter	Position	Path	Description	CWE
user_code	request body	/api/compiler/execute	Unauthenticated remote code execution via the /api/compiler/execute endpoint; no authentication decorator allows arbitrary code execution inside the container and access to sensitive data via a mounted /tmp volume.	CWE-250, CWE-284, CWE-693, CWE-78, CWE-94

17 Jun 2026 10:47Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.8 - 10

EPSS0.0113

SSVC

OpenLearnX Remote code execution Sandbox escape Code execution environment Version 2.0.3 Patched in update