OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

CRITIQUE 10.0CVE-2026-41900 · GHSA-8h25-q488-4hxw · Published 08/05/2026 · updated 26/10/2026

En bref

CVE-2026-41900 est une vulnérabilité CRITIQUE (CVSS 10.0) touchant openlearnx (th30d4y), openlearnx.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.91%, plus élevée que 60.0% des vulnérabilités.
Correctif : mettre à jour vers 2.0.3 ou plus récent.

Package	Affected versions	Patched versions
openlearnx th30d4y	`= 2.0.1`	No fix yet
openlearnx npm	`< 2.0.3`	`2.0.3`

Description

Overview

A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.

NVD description

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.

References

th30d4y/OpenLearnX security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41900 · ADVISORY
th30d4y/OpenLearnX commit 14765d7 · WEB
th30d4y/OpenLearnX · PACKAGE
th30d4y/OpenLearnX release v2.0.3-security-fix · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free