OpenLearnX versions prior to 2.0.3 are susceptible to OS command and code injection, allowing authenticated attackers to execute arbitrary commands.

The software suffers from OS command injection (CWE-78) and code injection (CWE-94) due to improper input handling. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that an authenticated user can exploit this vulnerability to achieve total technical impact.

Successful exploitation allows an attacker to execute arbitrary system commands, which could result in full server compromise, data exfiltration, or the installation of persistent backdoors. With a CVSS score of 8.8, the potential for total system takeover makes this a critical risk for any organization hosting the OpenLearnX platform.

Immediate Action: Update the OpenLearnX package to version 2.0.3 via npm to apply the security fix.

Proactive Monitoring: Inspect server logs for suspicious system calls or unexpected processes spawned by the OpenLearnX application service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns in HTTP requests.

Public Exploit Available: Yes — a public PoC exists on GitHub (Christbowel/CVE-2026-41900-POC).

Given the availability of a public proof-of-concept and the severity of the injection vulnerabilities, users of OpenLearnX must update to version 2.0.3 immediately. Failure to patch leaves the platform exposed to trivial remote code execution by authenticated users.