EUVD-2026-28346
GHSA-jqjr-j3vj-vwq3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.
AnalysisAI
Server-Side Template Injection in Open Notebook v1.8.3 enables arbitrary Python code execution and OS command execution within the Docker container through unsanitized user input in transformation features. The vulnerability requires local access (CVSS AV:L) but no authentication or user interaction, making it exploitable by any application user with access to the transformation creation interface. No public exploit code identified at time of analysis, though the GitHub security advisory provides technical details for reproduction.
Technical ContextAI
Open Notebook is a Python-based application running in Docker containers. The vulnerability stems from CWE-20 (Improper Input Validation) where user-supplied input for custom data transformations is processed through a Python templating engine without sanitization. Server-Side Template Injection (SSTI) occurs when an application embeds user input into templates that are then evaluated server-side. In Python environments, this commonly involves Jinja2 or similar engines that allow template expressions to access Python built-ins, enabling attackers to break out of the template sandbox and execute arbitrary code. The Docker containerized deployment provides some isolation but does not prevent code execution within the container context, potentially allowing access to container filesystem, environment variables, mounted volumes, and network resources accessible to the container.
RemediationAI
Upgrade to a patched version of Open Notebook as specified in the GitHub security advisory at https://github.com/lfnovo/open-notebook/security/advisories/GHSA-f35w-wx37-26q7. Upstream fix available (PR/commit); released patched version not independently confirmed from provided data. If immediate patching is not feasible, implement compensating controls: disable or restrict access to the user-created transformation feature through application configuration or role-based access controls, limiting this functionality only to fully trusted administrative users. Deploy additional Docker security hardening including read-only root filesystem (--read-only flag), dropped capabilities (--cap-drop=ALL), user namespace remapping, and seccomp/AppArmor profiles to limit potential impact of code execution. Monitor container activity for suspicious Python process creation or unexpected outbound network connections. Note that disabling transformations may break existing workflows dependent on this feature, requiring alternative data processing methods.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today