CVE-2026-53541: OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action’s configuration. However, a special case allows any argument whose name starts with ot_ to bypass this filter. While two system arguments (ot_executionTrackingId and ot_username) are injected by OliveTin and overridden, all other ot_-prefixed arguments supplied by the user pass through unmodified.

These bypassed arguments are:

1. Not type-checked — the validation loop only iterates over the action’s defined arguments, so ot_-prefixed arguments skip all type safety checks entirely.
2. Set as environment variables — via buildEnv(), with completely unvalidated values, and passed to the executed command.
3. Included in the template context — available as .Arguments.ot_* in template rendering.