LMFDB Template Rendering /knowledge/render/ render_knowl content special elements in template engine

Summaryinfo

A vulnerability, which was classified as critical, has been found in LMFDB. Impacted is the function render_knowl of the file /knowledge/render/ of the component Template Rendering. The manipulation of the argument content leads to special elements in template engine. This vulnerability is traded as CVE-2026-123198. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as critical, has been found in LMFDB (affected version unknown). This issue affects the function render_knowl of the file /knowledge/render/ of the component Template Rendering. The manipulation of the argument content with an unknown input leads to a special elements in template engine vulnerability. Using CWE to declare the problem leads to CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-123198 since 11/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1221 according to MITRE ATT&CK.

Applying the patch 01829bd09b692c720aad30c952758a20630573d4 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• LMFDB

Website

• Product: https://github.com/LMFDB/lmfdb/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion