CVE-2026-123198 LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lmfdb/lmfdb | < 01829bd09b692c720aad30c952758a20630573d4 | 01829bd09b692c720aad30c952758a20630573d4 |
References
- GitHub Security Advisory (GHSA-6jw3-pmcx-2xww) exploit vendor-advisory
- github.com issue-tracking patch
- github.com patch
- github.com technical-description
- VulnCheck Advisory: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID> third-party-advisory