Cyber Resilience

CVE-2026-41900

HighRCE

Published: 08 May 2026

Published
08 May 2026
Modified
29 May 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0091 55.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-41900 is a high-severity OS Command Injection (CWE-78) vulnerability in Th30D4Y Openlearnx. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in…

more

version 2.0.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

RCE via sandbox escape directly enables public-facing app exploitation (T1190), arbitrary command execution (T1059), and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24120Shared CWE-693, CWE-94
CVE-2025-41699Shared CWE-94
CVE-2026-3692Shared CWE-78
CVE-2025-1265Shared CWE-78
CVE-2025-70828Shared CWE-78
CVE-2026-25227Shared CWE-94
CVE-2026-32276Shared CWE-94
CVE-2026-1427Shared CWE-78
CVE-2024-43649Shared CWE-250, CWE-78
CVE-2026-26831Shared CWE-78, CWE-94

Affected Assets

th30d4y
openlearnx
2.0.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CONOPS explicitly defines intended operational roles, procedures, and privilege usage, reducing the likelihood of unnecessary privileges being assigned or retained during system operation.

Workforce programs emphasize least-privilege principles, directly reducing unnecessary privilege assignments.

Least-privilege engineering principle directly reduces execution with unnecessary privileges.

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

Hardware-enforced separation directly implements strong access control boundaries that software alone cannot bypass.

addresses: CWE-284 CWE-250

The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.

addresses: CWE-284 CWE-250

Supervision and review of access control activities directly detects and remediates improper access configurations or usages.

addresses: CWE-284 CWE-250

Defining account types, requiring approvals for creation, specifying authorizations, monitoring usage, and reviewing accounts directly prevents improper access control by ensuring only authorized accounts exist and are used.

References