Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-123198LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

Critical 9.8

In plain English

A critical-severity security flaw in LMFDB from LMFDB. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 41.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

Affected products (as reported)

Vendor	Product	Versions
LMFDB	LMFDB	0 – before 01829bd09b692c720aad30c952758a20630573d4

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-6jw3-pmcx-2xww) vendor-advisory
https://github.com/LMFDB/lmfdb/pull/7231 patch, issue-tracking
https://github.com/LMFDB/lmfdb/commit/01829bd09b692c720aad30c952758a20630573d4 patch
https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 technical-description
VulnCheck Advisory: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID> third-party-advisory