CVE-2026-123198 LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123198?
CVE-2026-123198 is a critical vulnerability in LMFDB, published on 5 Nov 2026.
Official description
LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.
Weakness: CWE-1336
Which versions are affected by CVE-2026-123198?
How do I fix CVE-2026-123198?
No fix has been published for CVE-2026-123198 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123198 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123198 exists.
Sources
Also known as GHSA-6jw3-pmcx-2xww.