OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

KRITISCH 10.0CVE-2026-41900 · GHSA-8h25-q488-4hxw · Published 08/05/2026 · updated 26/10/2026

Kurz gesagt

CVE-2026-41900 ist eine Schwachstelle (KRITISCH (CVSS 10.0)) in openlearnx (th30d4y), openlearnx.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.91%, höher als bei 60.0% aller Schwachstellen.
Abhilfe: auf 2.0.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
openlearnx th30d4y	`= 2.0.1`	No fix yet
openlearnx npm	`< 2.0.3`	`2.0.3`

Description

Overview

A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.

NVD description

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.

References

th30d4y/OpenLearnX security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41900 · ADVISORY
th30d4y/OpenLearnX commit 14765d7 · WEB
th30d4y/OpenLearnX · PACKAGE
th30d4y/OpenLearnX release v2.0.3-security-fix · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free