CVE-2026-33587 - Vulnerability Analysis

Overview

Open Notebook v1.8.3 contains a server-side template injection caused by lack of user input sanitisation in user-created transformations, letting application users execute Python code and OS commands on the docker container, exploit requires user access.

Severity & Score

Impact

Application users can execute arbitrary Python code and OS commands on the docker container, potentially leading to full system compromise.

Mitigation

Update to the latest version with input sanitisation fixes.

References

• https://github.com/lfnovo/open-notebook/security/advisories/GHSA-f35w-wx37-26q7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner