CVE-2026-123198: falha crítica em LMFDB
LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.8%
LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
LMFDB · LMFDBReferências
https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747https://github.com/LMFDB/lmfdb/commit/01829bd09b692c720aad30c952758a20630573d4https://github.com/LMFDB/lmfdb/pull/7231https://github.com/LMFDB/lmfdb/security/advisories/GHSA-6jw3-pmcx-2xwwhttps://www.vulncheck.com/advisories/lmfdb-before-commit-01829bd-unauthenticated-server-side-template-injection-via-knowledge-render-id