CVE-2026-123198: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

Published Nov 5, 2026

Updated

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the renderknowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Any deployment running an LMFDB version before commit 01829bd is exposed if the /knowledge/render/<ID> endpoint is reachable by an attacker. No authentication is required.

What does an attacker need to exploit it?

An attacker needs only network access to the affected endpoint and the ability to submit crafted query-string values or content data. Exploitation does not require credentials or user interaction.

What level of access can exploitation provide?

Successful exploitation can reach Python builtins and execute operating system commands as the web application account. This can impact confidentiality, integrity, and availability of the affected application environment.

How can I determine whether my instance is affected?

Check whether the deployed LMFDB source includes commit 01829bd09b692c720aad30c952758a20630573d4. Instances before that commit should be treated as affected.

CVE-2026-123198: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

What level of access can exploitation provide?

How can I determine whether my instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

What level of access can exploitation provide?

How can I determine whether my instance is affected?