CVE-2026-41900
criticalOpenLearnX is an open-source, decentralized learning and assessment platform.
Vendor / product: Th30d4y — openlearnx
OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.
CVSS
10.0
10.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-05-08 04:16
Modified: 2026-10-26 20:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
th30d4y / openlearnx 2.0.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/th30d4y/OpenLearnX/commit/14765d7d1856d564747c55c5412e2f38feab079e security-advisories@github.com
- https://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.3-security-fix security-advisories@github.com
- https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-8h25-q488-4hxw security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗