Paper/Archive/CVE-2026-41900

CVE-2026-41900

th30d4y OpenLearnX — OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

EPSS 0.9%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (NVD)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 59.9.599 × 2012.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.

Affected

ProductAffectedFixed inSource

OpenLearnX< 2.0.3–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

GitHub_M (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw refgithub.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e refgithub.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix