CVE-2026-123198

LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

9.3 Critical

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.84%Unchanged since Nov 6, 2026

What each source reports

CVE List Score used 9.3

LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

Record: CVE-2026-123198
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1336
Updated: 2026-11-05

EUVDEUVD-2026-117643 9.3

Record: EUVD-2026-117643
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-05

NVD 9.3

Record: CVE-2026-123198
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1336
Updated: 2026-11-05

OSV 9.3

LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

Record: CVE-2026-123198
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-1336
Updated: 2026-11-07

Affected products

lmfdb

History

History
Recorded	Changed	Sources
Nov 7, 2026	references	EUVD, NVD, OSV
Nov 5, 2026	aliases, references	NVD, OSV
Nov 5, 2026	references	CVE List
Nov 5, 2026	cwes, references, severity, title	CVE List
Nov 5, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-123198 is a critical vulnerability (CVSS 9.3) in Lmfdb, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. No source names a fixed version.