---
id: CVE-2026-123198
title: >-
  LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via
  /knowledge/render/<ID>
summary: >-
  LMFDB before commit 01829bd contains a server-side template injection
  vulnerability in the render_knowl function that allows unauthenticated
  attackers to inject Jinja expressions via request parameters. Attackers can
  supply crafted query…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1336
vendor: LMFDB
product: LMFDB
affected:
  - LMFDB < 01829bd09b692c720aad30c952758a20630573d4
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T20:59:31.250923Z'
exploitAvailable: true
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:59:50.463Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123198'
references:
  - url: 'https://github.com/LMFDB/lmfdb/security/advisories/GHSA-6jw3-pmcx-2xww'
    label: GitHub Security Advisory (GHSA-6jw3-pmcx-2xww)
  - url: 'https://github.com/LMFDB/lmfdb/pull/7231'
  - url: >-
      https://github.com/LMFDB/lmfdb/commit/01829bd09b692c720aad30c952758a20630573d4
  - url: >-
      https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747
  - url: >-
      https://www.vulncheck.com/advisories/lmfdb-before-commit-01829bd-unauthenticated-server-side-template-injection-via-knowledge-render-id
    label: >-
      VulnCheck Advisory: LMFDB before commit 01829bd Unauthenticated
      Server-Side Template Injection via /knowledge/render/<ID>
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-05T22:38:31.939Z'
epss: 0.00845
epssPercentile: 0.58263
---

## Overview

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

## Affected

- `LMFDB < 01829bd09b692c720aad30c952758a20630573d4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.