CVE-2026-33587

CriticalCVSS 10.0/10Last modified Nov 11, 2026

Description

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Open Notebook	Open Notebook	<= 1.8.3

References

https://github.com/lfnovo/open-notebook/security/advisories/GHSA-f35w-wx37-26q7Vendor Advisory

Timeline

Published: May 7, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-335888.1Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files CVE-2026-335896.5Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files con CVE-2026-33597.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inpu CVE-2026-335908.5Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code e CVE-2026-3359110.0A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a s CVE-2026-335927.5An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of Fin CVE-2026-335937.5A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-335947.5A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing querie CVE-2026-335957.5A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some reso CVE-2026-335966.5A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of CVE-2026-335977.5PRSD detection denial of service CVE-2026-335989.1A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a