CVE-2026-28201 — SurrealDB Injection on Open Notebook
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or…
Published: 2026-05-07 · CVSS: 8.7 · CVSS 4.0
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7