{"id":"CVE-2026-41900","aliases":["EUVD-2026-28500","GHSA-8h25-q488-4hxw"],"status":"published","title":"OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment","description":"OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0091,"percentile":0.60288,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-250","CWE-284","CWE-693","CWE-78","CWE-94"],"published":"2026-04-23T21:46:07Z","modified":"2026-10-28T02:30:58Z","exploits":[{"source":"pocgithub","id":"Christbowel/CVE-2026-41900-POC","title":"Christbowel/CVE-2026-41900-POC","date":"2026-05-06","url":"https://github.com/Christbowel/CVE-2026-41900-POC"}],"fixes":[{"ecosystem":"npm","package":"openlearnx","fixed_in":["2.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openlearnx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"openlearnx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]}],"products":[{"vendor":"th30d4y","product":"openlearnx"}],"references":[{"url":"https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41900","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8h25-q488-4hxw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41900.json","tags":["advisory"]},{"url":"https://github.com/th30d4y/OpenLearnX","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-41900","title":"OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment","description":"OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.","status":"published","published":"2026-05-08T03:25:50.286Z","modified":"2026-05-08T12:54:17.267Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78","CWE-94","CWE-250","CWE-284","CWE-693"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-28500","description":"OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.","status":"published","published":"2026-05-08T03:25:50Z","modified":"2026-05-08T12:54:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:14.505765Z"}],"ghsa":[{"id":"GHSA-8h25-q488-4hxw","title":"OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment","description":"##  Overview\n\nA critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.","status":"published","published":"2026-04-23T21:46:07Z","modified":"2026-05-11T13:49:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78","CWE-94","CWE-250","CWE-284","CWE-693"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2026-41900","description":"OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.","status":"published","published":"2026-05-08T04:16:18.71Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78","CWE-94","CWE-250","CWE-284","CWE-693"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-41900","title":"OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment","description":"OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.","status":"published","published":"2026-05-08T03:25:50.286Z","modified":"2026-10-28T02:30:58.040085884Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250","CWE-284","CWE-693","CWE-78","CWE-94"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"GHSA-8h25-q488-4hxw","title":"OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment","description":"##  Overview\n\nA critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.","status":"published","published":"2026-04-23T21:46:07Z","modified":"2026-05-11T14:12:50.584064Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250","CWE-284","CWE-693","CWE-78","CWE-94"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}