OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

CRÍTICO 10.0CVE-2026-41900 · GHSA-8h25-q488-4hxw · Published 08/05/2026 · updated 26/10/2026

En resumen

CVE-2026-41900 es una vulnerabilidad CRÍTICO (CVSS 10.0) que afecta a openlearnx (th30d4y), openlearnx.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.91%, mayor que el 60.0% de las vulnerabilidades.
Solución: actualizar a 2.0.3 o posterior.

Package	Affected versions	Patched versions
openlearnx th30d4y	`= 2.0.1`	No fix yet
openlearnx npm	`< 2.0.3`	`2.0.3`

Description

Overview

A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.

NVD description

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.

References

th30d4y/OpenLearnX security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41900 · ADVISORY
th30d4y/OpenLearnX commit 14765d7 · WEB
th30d4y/OpenLearnX · PACKAGE
th30d4y/OpenLearnX release v2.0.3-security-fix · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free