CVE-2026-123198

Name of the Vulnerable Software and Affected Versions LMFDB versions prior to commit 01829bd

Description An issue exists in the render knowl() function that allows unauthenticated attackers to perform server-side template injection. By providing crafted query-string values or content data to the '/knowledge/render/' endpoint, attackers can inject Jinja expressions to access Python builtins and execute operating system commands with the privileges of the web application account.

Recommendations Update to commit 01829bd or a newer version. As a temporary workaround, restrict access to the '/knowledge/render/' endpoint.