Cloudanix VulnDB

GHSA-xx6g-43w2-9g6g

Medium · 6.5

OliveTin's email argument makes compliance harder, enables log injection

CVSS

6.5

EPSS

—

Published

Mar 12, 2026

CISA due date

—

The record

The typeSafetyCheckEmail() function in service/internal/executor/arguments.go calls log.Errorf() on every invocation including when validation succeeds (err == nil). This means every email address submitted by any user is written to the application's ERROR-level log unconditionally. Because the raw user-supplied value is logged without sanitization, an attacker can inject newline characters to forge arbitrary structured log entries (log injection). In deployments using centralized logging (ELK, Splunk, Grafana), the injected lines are parsed as real events, enabling fake security alerts, audit trail manipulation, and persistent misdirection of incident response.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities