{"id":"CVE-2026-123198","title":"LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>","summary":"LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-1336"],"vendor":"LMFDB","product":"LMFDB","affected":["LMFDB < 01829bd09b692c720aad30c952758a20630573d4"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-11-05T20:59:31.250923Z"},"exploitAvailable":true,"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:59:50.463Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123198","references":[{"url":"https://github.com/LMFDB/lmfdb/security/advisories/GHSA-6jw3-pmcx-2xww","label":"GitHub Security Advisory (GHSA-6jw3-pmcx-2xww)"},{"url":"https://github.com/LMFDB/lmfdb/pull/7231"},{"url":"https://github.com/LMFDB/lmfdb/commit/01829bd09b692c720aad30c952758a20630573d4"},{"url":"https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747"},{"url":"https://www.vulncheck.com/advisories/lmfdb-before-commit-01829bd-unauthenticated-server-side-template-injection-via-knowledge-render-id","label":"VulnCheck Advisory: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-11-05T22:38:31.939Z","epss":0.00845,"epssPercentile":0.58263,"slug":"CVE-2026-123198","body":"## Overview\n\nLMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.\n\n## Affected\n\n- `LMFDB < 01829bd09b692c720aad30c952758a20630573d4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}