CVE-2026-41900 is a high severity remote code execution flaw (CVSS 8.8) in OpenLearnX, an open source learning and assessment platform. Before version 2.0.3, its code execution environment allows a sandbox escape and arbitrary command execution. Upgrade to 2.0.3.
What's affected
Per the GitHub advisory for the npm package openlearnx, version 2.0.1 is listed as affected and 2.0.3 is patched. The record says versions before 2.0.3 are affected. The project published a release tagged v2.0.3-security-fix. The advisory gives few details beyond a sandbox escape in the code execution environment.
How to check if you're exposed
npm ls openlearnx
If you run the platform from source, check the release tag or commit you deployed. Then find out whether the code execution feature is enabled and who can use it: students, public visitors or only trusted staff. The vector requires low privileges, so any user account may be enough.
What to do now
- Upgrade to OpenLearnX 2.0.3 or later.
- Until then, turn off the code execution feature, or restrict it to trusted users.
- Run the platform in a container with no secrets and limited network access.
- Review the server for unexpected processes or files if code execution was open to many users.
Why it matters
The record lists several classes: CWE-250 (execution with unnecessary privileges), CWE-284 (improper access control), CWE-693 (protection mechanism failure), CWE-78 (OS command injection) and CWE-94 (code injection).
Any product that runs user submitted code, such as online judges and coding labs, is exposed to sandbox quality. In-process filtering is weak. Strong isolation uses containers or virtual machines with no network, tight resource limits and no host secrets. The record does not flag this CVE as known exploited.
Quick check
Is turning off code execution an acceptable stopgap?
It removes the vulnerable feature until you can upgrade. Confirm the feature is fully off, and then upgrade.
Sources
Last reviewed: 19 October 2026.
