CVE-2026-33587 — Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)
Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side…
Published: 2026-05-07 · CVSS: 9.2 · CVSS 4.0
Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7