CVE-2026-48708: OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

OliveTin’s template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each ExecRequest spawns a goroutine), a race condition occurs: one goroutine’s Parse overwrites the template tree while another goroutine is calling Execute, causing:

1. Cross-user command contamination: User A’s arguments rendered in User B’s shell command template
2. Go runtime panic: Concurrent map writes in Go’s text/template internal structures cause a fatal crash
3. Incorrect command execution: Template/argument mismatch produces unexpected or dangerous shell commands