CVE-2026-41900CWE-250CWE-284CWE-693CWE-78CWE-94

OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

High · published May 8, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01130 · 66.1th percentile
Weaknesses
CWE-250 · Execution with Unnecessary Privileges; CWE-284 · Improper Access Control; CWE-693 · Protection Mechanism Failure; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-08T03:25Z
EPSS history
Timeline
  • 08 MAY 03:25Z
    OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
    cvelistv5