Loading vulnerability…
CVE-2026-41900 is a remote code execution vulnerability in the OpenLearnX code execution environment affecting versions prior to 2.0.3. The flaw allows an attacker to escape the intended sandbox and execute arbitrary operating system commands. The available advisory information identifies the issue as occurring within the platform's code execution environment, but does not provide the specific vulnerable function or code path. The vulnerability was fixed in OpenLearnX 2.0.3.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a single standalone Python exploit (exploit.py) plus a README. The exploit targets OpenLearnX CVE-2026-41900 / GHSA-8h25-q488-4hxw, described as an unauthenticated remote code execution and information disclosure issue in pre-patch OpenLearnX versions before commit 14765d7. The script is not part of a larger framework and uses only Python standard library modules such as argparse and urllib. Core exploit flow: it probes a small set of candidate HTTP execution endpoints (/api/compiler/execute, /api/coding/execute, /execute), identifies a live endpoint, and submits attacker-controlled Python code for execution. The intended vulnerable condition is that the backend writes user code to a tempfile under /tmp and mounts the tempfile directory into a Docker container as /app. Because the mount resolves to /tmp rather than an isolated directory, the attacker can browse and read unrelated temporary files from the host/app context. The README further states the container runs as root with default capabilities, which the exploit validates using dedicated gadgets. Capabilities implemented in the script include: vulnerability checking (--check), full exploitation with all gadgets and evidence generation (--exploit), arbitrary single-command execution (-c/--command), pseudo-interactive shell access (--shell), and selective gadget execution (--gadget). The gadget set shown in the provided content includes listing mounted files under /app, harvesting secrets from common file extensions, reading other Python submissions, and checking privilege/capability state. This makes the exploit both a verifier and an operational post-exploitation utility for data disclosure within the mounted volume. Repository structure is minimal and purpose-built: README.md documents the vulnerability, exploitation workflow, sample outputs, and lab reproduction steps; exploit.py is the main entry point and operational PoC. Overall, this is a real exploit PoC with practical offensive functionality rather than a mere detector.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.