CVE-2026-33587 — Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)

CVE-2026-33587

Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) PUBLISHED

Description (CNA)

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.

Affected (CNA)

Vendor / product	Versions
Open Notebook / Open Notebook	affected 0 through 1.8.3

CWE

CWE-20

References

https://github.com/lfnovo/open-notebook/security/advisories/GHSA-f35w-wx37-26q7

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.