OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

CRÍTICO 10.0CVE-2026-41900 · GHSA-8h25-q488-4hxw · Published 08/05/2026 · updated 26/10/2026

Em resumo

CVE-2026-41900 é uma vulnerabilidade CRÍTICO (CVSS 10.0) que afeta openlearnx (th30d4y), openlearnx.
Chance de exploração nos próximos 30 dias (EPSS): 0.91%, maior que 60.0% das vulnerabilidades.
Correção: atualize para 2.0.3 ou posterior.

Package	Affected versions	Patched versions
openlearnx th30d4y	`= 2.0.1`	No fix yet
openlearnx npm	`< 2.0.3`	`2.0.3`

Description

Overview

A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.

NVD description

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.

References

th30d4y/OpenLearnX security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41900 · ADVISORY
th30d4y/OpenLearnX commit 14765d7 · WEB
th30d4y/OpenLearnX · PACKAGE
th30d4y/OpenLearnX release v2.0.3-security-fix · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free