Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-33587

Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ENISA

Description

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Open Notebook Open Notebook

Default version status: unaffected

  • 0 to ≤ 1.8.3affected

References