# Security Advisory Duplicates — Maintainer Guide

This document lists known duplicate security advisory clusters for [OliveTin/OliveTin](https://github.com/OliveTin/OliveTin). When triaging new reports, check here and [open advisories](https://github.com/OliveTin/OliveTin/security/advisories) before accepting.

**Duplicate policy:** the earliest reporter on the canonical advisory receives primary credit. Later reporters are credited on the canonical advisory when closed as duplicates. See [SECURITY.md](../SECURITY.md).

## Triage checklist

1. Search open advisories for the same component and attack path.
2. Reject if the issue only affects feature-flagged / alpha functionality (`features.*` in config; see [SECURITY.md](../SECURITY.md#feature-flags-alpha--experimental)). Ask the reporter to open a normal GitHub issue instead; do not request a CVE.
3. Match against clusters below.
4. If duplicate: close the newer advisory, link to canonical, add reporter to canonical credits.
5. If unique: accept, patch on a private branch, reassess CVSS with OliveTin context (see SECURITY.md — OliveTin is intentional RCE by design).
6. Merge fix to `next`, publish advisory, credit reporters in advisory body (not commit message).

---

## shellAfterCompleted command injection

**Canonical:** [GHSA-vc6p-m6vx-6cwq](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-vc6p-m6vx-6cwq) — reporter **knight-yagami** (2026-03-04)

Untrusted command output or template variables interpolated into `shellAfterCompleted` and executed via `sh -c`.

| GHSA | Reporter | Status | Notes |
|------|----------|--------|-------|
| GHSA-vc6p-m6vx-6cwq | knight-yagami | closed (canonical) | Original report |
| GHSA-v5gc-hqpq-227p | 0xkakash1 | closed (duplicate) | Output template variant |
| GHSA-m7wr-wj5j-7459 | Ryu7zz | duplicate | Webhook `exec` → output → `shellAfterCompleted` |
| GHSA-cjxm-x848-6vmc | Yesuhei | duplicate | Missing shell safety on after-completion |
| GHSA-j9p9-36jc-2v8w | anushkavirgaonkar | duplicate | Same root cause |

**Fix:** shell-quote `output`/`exitCode` before template render; block `shellAfterCompleted` for webhook-tagged actions.

**CVSS note:** requires admin-configured `shellAfterCompleted` and attacker influence on output — typically PR:H not PR:N.

---

## OAuth2 state map memory exhaustion (DoS)

**Canonical:** [GHSA-xpxj-f2fm-rqch](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch) — reporter **knight-yagami** (2026-03-04)

Unauthenticated `/oauth/login` grows `registeredStates` without TTL or cap.

| GHSA | Reporter | Status | Notes |
|------|----------|--------|-------|
| GHSA-xpxj-f2fm-rqch | knight-yagami | closed (canonical) | Original report |
| GHSA-cj96-c55v-2f3c | Dredsen | duplicate | Same unbounded map |

**Fix:** TTL sweep (match 15-minute cookie MaxAge), max map size, cleanup on failed callback.

**CVSS note:** unauthenticated DoS — reported 7.5 is appropriate.

---

## URL argument type — unrestricted URI schemes (SSRF / file read)

**Canonical:** [GHSA-45pc-w4ph-hrq4](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45pc-w4ph-hrq4) — reporter **fg0x0** (2026-03-09)

`url` type accepts `file://`, `gopher://`, etc. Blocked in `shell:` mode but still validated weakly for `exec:` actions.

| GHSA | Reporter | Status | Notes |
|------|----------|--------|-------|
| GHSA-45pc-w4ph-hrq4 | fg0x0 | closed (canonical) | Original report |
| GHSA-cchg-25m4-q6rj | anushkavirgaonkar | duplicate | Same scheme validation gap |

**Fix:** allowlist `http`/`https` in `typeSafetyCheckUrl`.

**CVSS note:** admin must configure `exec:` action passing URL to external tool — PR:H.

---

## Custom `regex:` argument type in shell actions

**Canonical:** [GHSA-xc5w-4v5w-7x65](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65) — reporter **Ayantaker** (2026-05-06)

`regex:` types not in shell denylist; partial `MatchString` allows injection suffixes.

| GHSA | Reporter | Status | Notes |
|------|----------|--------|-------|
| GHSA-xc5w-4v5w-7x65 | Ayantaker | canonical | Missing denylist entry |
| GHSA-gvxq-7gvp-4ggr | anushkavirgaonkar | duplicate | Unanchored partial match |

**Fix:** deny `regex:` in shell mode; enforce full-string match for custom regex types.

---

## Shell denylist incomplete (post CVE-2026-27626)

**Canonical:** [GHSA-c26w-h42g-jfp9](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-c26w-h42g-jfp9) — reporter **sec-reex** (2026-07-03)

CVE-2026-27626 added `password` to denylist only; `html`, `confirmation`, and choiceless `checkbox` still skip validation and are allowed in `shell:` actions.

**Fix:** extend `checkShellArgumentSafety` denylist.

---

## StartActionAndWait logs ACL bypass

**Canonical:** [GHSA-jm28-2wcr-qf3h](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jm28-2wcr-qf3h) — reporter **offset** (2026-03-12)

`StartActionAndWait` / `StartActionByGetAndWait` return full log output without `logs` ACL check.

No known duplicates.

**Fix:** apply `isLogEntryAllowed` before returning `LogEntry`.

**CVSS note:** requires authenticated user with `exec` but not `logs` — typically 4.3–5.3 not 6.5.

---

## Easy to confuse (not duplicates)

| Topic | Advisories | Distinction |
|-------|------------|-------------|
| OAuth2 state DoS vs OAuth2 auth bypass | GHSA-xpxj vs GHSA-3v7p | DoS fills state map; bypass spoofs `authHttpHeaderUsername` |
| `shellAfterCompleted` vs direct `shell` injection | GHSA-vc6p vs GHSA-49gm | Second-order via output vs first-order argument injection |
| `ValidateArgumentType` enumeration | GHSA-f637 vs GHSA-x6q3 | Same issue; GHSA-f637 published |