EUVD-2026-330003

fkie_cve-2026-48708

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each ExecRequest spawns a goroutine), a race condition occurs: one goroutine's Parse overwrites the template tree while another goroutine is calling Execute, causing cross-user command contamination, Go runtime panic, and incorrect command execution. This issue has been resolved in version 3000.13.0.

GHSA-7fq5-7wr8-rjwj — OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

Affected: Go: github.com/OliveTin/OliveTin

## Summary

OliveTin's template engine uses a **single shared `text/template.Template` instance** (`tpl` package-level variable in `service/internal/tpl/templates.go`) across all goroutines. Every action execution calls `tpl.Parse(source)` followed by `t.Execute()` on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each `ExecRequest` spawns a goroutine), a race condition occurs: one goroutine's `Parse` overwrites the template tree while another goroutine is calling `Execute`, causing:

1. **Cross-user command contamination**: User A's arguments rendered in User B's shell command template 2. **Go runtime panic**: Concurrent map writes in Go's `text/template` internal structures cause a fatal crash 3. **Incorrect command execution**: Template/argument mismatch produces unexpected or dangerous shell commands

## CWE

- CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) - CWE-567 (Unsynchronized Access to Shared Data in a Multithreaded Context)

## Affected Versions

- All versions (the shared template has existed since the template system was introduced)

## Details

### The Shared Template Instance

In `service/internal/tpl/templates.go`:

```go var tpl = template.New("tpl"). Option("missingkey=error"). Funcs(template.FuncMap{"Json": jsonFunc}) ```

This is a **package-level variable** — a single `*template.Template` shared across the entire process.

### Unsafe Pars…

Most recent entries from all

EUVD-2026-330003

fkie_cve-2026-48708

GHSA-7fq5-7wr8-rjwj — OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination