CVE-2026-123198 · Other
NO FIX YET · SEE WHAT TO DO
LMFDB, the L-functions and modular forms database web application, has a server-side template injection in its render_knowl function. An unauthenticated attacker can send crafted query-string values or content data to /knowledge/render/<ID> and reach Python builtins to execute operating system commands as the web application account.
first public Nov 2, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any deployment of LMFDB built from a commit before 01829bd that serves the knowledge rendering route is exposed, since the flaw is reachable without an account. Operators who run LMFDB only on a closed network or who do not serve the /knowledge/render/ endpoint are less exposed. The sources do not say whether managed or hosted instances are affected.
Not affected if commit-01829bd-or-later
Who cares jinja2, lmfdb, python, self-hosted, web
01829bd, for example with git log on the deployed checkout/knowledge/render/ in web server logs with Jinja-style syntax such as {{ or }} in query parameters or content fields01829bd (the sources name the patch commit only)LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.